healer | 196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 21:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe
Size

836KB
MD5

3bc902d6f2a7a73542e27ddf7a3a0fdd
SHA1

a06f176274ba830785eb62c778745513f531f72f
SHA256

196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489
SHA512

bbdf7a0f392d4acc5acf12074298ed4c835eaa2cf178c4a79ba46a44c38fef8bb32b66eabd34fe7c11448130d64679a59a968da4e59ef5b89c181fe507972ee6
SSDEEP

24576:EyphJLOznU7kzsaghOB5ZKixAg7xieOU:TpvGnWUgh2Z7Ag7xzO

Score

10^/10

healer redline gena discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023cd5-20.dat	healer
behavioral1/memory/2928-22-0x00000000009F0000-0x00000000009FA000-memory.dmp	healer
behavioral1/memory/2924-29-0x0000000004960000-0x000000000497A000-memory.dmp	healer
behavioral1/memory/2924-31-0x0000000004AA0000-0x0000000004AB8000-memory.dmp	healer
behavioral1/memory/2924-32-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-39-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-59-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-57-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-55-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-53-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-51-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-49-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-47-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-45-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-43-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-41-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-37-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-35-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer
behavioral1/memory/2924-33-0x0000000004AA0000-0x0000000004AB2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f4288rT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f4288rT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	h28gv29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	h28gv29.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f4288rT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f4288rT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	f4288rT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f4288rT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	h28gv29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	h28gv29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	h28gv29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	h28gv29.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/860-67-0x0000000004A70000-0x0000000004AB6000-memory.dmp	family_redline
behavioral1/memory/860-68-0x0000000007110000-0x0000000007154000-memory.dmp	family_redline
behavioral1/memory/860-98-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-102-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-100-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-96-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-94-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-92-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-90-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-88-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-86-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-84-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-80-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-78-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-76-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-74-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-73-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-82-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-70-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline
behavioral1/memory/860-69-0x0000000007110000-0x000000000714E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1728	niba3690.exe
4992	niba6407.exe
2928	f4288rT.exe
2924	h28gv29.exe
860	iAtBR71.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	h28gv29.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	f4288rT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	h28gv29.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	niba3690.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	niba6407.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4472	sc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2460	2924	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iAtBR71.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	niba3690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	niba6407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	h28gv29.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2928	f4288rT.exe
2928	f4288rT.exe
2924	h28gv29.exe
2924	h28gv29.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	f4288rT.exe
Token: SeDebugPrivilege	2924	h28gv29.exe
Token: SeDebugPrivilege	860	iAtBR71.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1728	1256	196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe	83
PID 1256 wrote to memory of 1728	1256	196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe	83
PID 1256 wrote to memory of 1728	1256	196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe	83
PID 1728 wrote to memory of 4992	1728	niba3690.exe	84
PID 1728 wrote to memory of 4992	1728	niba3690.exe	84
PID 1728 wrote to memory of 4992	1728	niba3690.exe	84
PID 4992 wrote to memory of 2928	4992	niba6407.exe	85
PID 4992 wrote to memory of 2928	4992	niba6407.exe	85
PID 4992 wrote to memory of 2924	4992	niba6407.exe	97
PID 4992 wrote to memory of 2924	4992	niba6407.exe	97
PID 4992 wrote to memory of 2924	4992	niba6407.exe	97
PID 1728 wrote to memory of 860	1728	niba3690.exe	102
PID 1728 wrote to memory of 860	1728	niba3690.exe	102
PID 1728 wrote to memory of 860	1728	niba3690.exe	102

C:\Users\Admin\AppData\Local\Temp\196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe
"C:\Users\Admin\AppData\Local\Temp\196c19244e469a67488a589631d1d70e5754c2605fc46731b0bbda60278d6489.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba3690.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba3690.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6407.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6407.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4288rT.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4288rT.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h28gv29.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h28gv29.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 1088
        5⤵
        Program crash
        
        PID:2460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iAtBR71.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iAtBR71.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2924 -ip 2924
1⤵
PID:4672

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba3690.exe

Filesize
694KB

MD5
ae738acfb3cb4647b331759bc689e1ae

SHA1
ec8b684736fca6eeff023cd2b4a6fe1618167668

SHA256
4b7e792b0bf6018f4809db97d5a9c6aaf381f127e086fecc0a559b24a7392258

SHA512
00e61ea405a0d4c3fa2a39eae2dd86d4115ec60f856a66e7325e047a8763a655bcdb1be669d2349dbef5db8a66a3cd5958cb9d25a93c96a7e961df66d0a355e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iAtBR71.exe

Filesize
391KB

MD5
869f689e6dff9412d2dbf96462ce8191

SHA1
f7e88ea3bc905d0ec98ce151710dfb3bd8cf0acc

SHA256
2d9655520b48c077f092e501d28791fe2e9804c01502822cb7d90a9aaf379ed7

SHA512
8007f67bf495919bd42d43393a7c8ee32c4e52ee9d63e8be655b6b46cccecd4e777edc000c12da25231ade2677585859b55a9fd694269b64471f10239e912989

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba6407.exe

Filesize
344KB

MD5
50ca4870c87137501e12fc407ee1c6b9

SHA1
33b1ddf53b76d0df6dce75d54ecef10a7db9d8f3

SHA256
0c52c6ecdea1db2b78205f97d41a7cca5858e66f6e0b5c39cfd69b47702b40d2

SHA512
8c574ff0894462b94d32c816beb8b22548c9f3b69dd4d2ea4d14a5e5e18daeb755bd0cd58a9db4312f75e4f7bd7ea1d4fc6adeca009a88c9f1f5638f66d398c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4288rT.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h28gv29.exe

Filesize
334KB

MD5
89fb31bad28227ef91efcb224a8b06c4

SHA1
e77c5e40d446dbcc9b2b4fbe313e23a354df2ba8

SHA256
74ce20c90114868f465cfa72318d5a6a25aefb06219be7955cbb929b87f1f343

SHA512
400d9947247f3ec5d1dd96cd40b89849019e9b7ec3f62379e7c652afa58b0fe12e635ebe354880baf89f1e3c8a77ccb22fb1d5ff4eb3c1cc8c0930aaaed9bce5

Download Submit
memory/860-74-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-84-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-976-0x0000000007ED0000-0x0000000007FDA000-memory.dmp

Filesize
1.0MB

Download
memory/860-975-0x00000000078B0000-0x0000000007EC8000-memory.dmp

Filesize
6.1MB

Download
memory/860-69-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-70-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-82-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-73-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-978-0x0000000007260000-0x000000000729C000-memory.dmp

Filesize
240KB

Download
memory/860-98-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-76-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-78-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-80-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-977-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/860-86-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-88-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-90-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-92-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-94-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-96-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-100-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-979-0x00000000080E0000-0x000000000812C000-memory.dmp

Filesize
304KB

Download
memory/860-102-0x0000000007110000-0x000000000714E000-memory.dmp

Filesize
248KB

Download
memory/860-67-0x0000000004A70000-0x0000000004AB6000-memory.dmp

Filesize
280KB

Download
memory/860-68-0x0000000007110000-0x0000000007154000-memory.dmp

Filesize
272KB

Download
memory/2924-57-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-62-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/2924-60-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/2924-33-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-35-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-37-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-41-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-43-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-45-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-47-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-49-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-51-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-53-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-55-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-59-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-39-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-32-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

Filesize
72KB

Download
memory/2924-31-0x0000000004AA0000-0x0000000004AB8000-memory.dmp

Filesize
96KB

Download
memory/2924-30-0x0000000007360000-0x0000000007904000-memory.dmp

Filesize
5.6MB

Download
memory/2924-29-0x0000000004960000-0x000000000497A000-memory.dmp

Filesize
104KB

Download
memory/2928-23-0x00007FFA70F63000-0x00007FFA70F65000-memory.dmp

Filesize
8KB

Download
memory/2928-22-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download
memory/2928-21-0x00007FFA70F63000-0x00007FFA70F65000-memory.dmp

Filesize
8KB

Download