healer | 6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe
Size

1.2MB
MD5

c5b59042661015275227613121d77f88
SHA1

934b2a5bc3222ac797802d2551f9de03a8bc345b
SHA256

6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022
SHA512

81a03c27f7fd69057462db724b9132e3d0f43dac108c031efc809b111adadb9df555ea488545de474f5862b1575b13650686cf6b17f7961bf72d0b0b8682004f
SSDEEP

24576:6F6srZaBvdwb0VkOx6Jgn9QZjZhF87xJDHvniWFtNcm5hZn47i2+hz:6F6zhdwb0ZkCn9+dhylBHvnLH3hZV

Score

10^/10

healer redline gena discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b99-30.dat	healer
behavioral2/memory/512-32-0x0000000000090000-0x000000000009A000-memory.dmp	healer
behavioral2/memory/468-42-0x0000000004A70000-0x0000000004A8A000-memory.dmp	healer
behavioral2/memory/468-44-0x0000000004C60000-0x0000000004C78000-memory.dmp	healer
behavioral2/memory/468-45-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-50-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-70-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-68-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-66-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-64-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-62-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-60-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-58-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-56-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-54-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-52-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-72-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-48-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer
behavioral2/memory/468-46-0x0000000004C60000-0x0000000004C72000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bus3141.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bus3141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	con6381.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bus3141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bus3141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bus3141.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bus3141.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral2/memory/932-81-0x00000000049D0000-0x0000000004A16000-memory.dmp	family_redline
behavioral2/memory/932-82-0x0000000004C80000-0x0000000004CC4000-memory.dmp	family_redline
behavioral2/memory/932-108-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-114-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-112-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-110-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-106-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-104-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-102-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-100-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-98-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-96-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-94-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-92-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-90-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-88-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-86-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-84-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline
behavioral2/memory/932-83-0x0000000004C80000-0x0000000004CBE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1340	kino8975.exe
536	kino8972.exe
1040	kino1803.exe
512	bus3141.exe
468	con6381.exe
932	deN99s33.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bus3141.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	con6381.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	con6381.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kino8975.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kino8972.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kino1803.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3228	468	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	deN99s33.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino8975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino8972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kino1803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	con6381.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
512	bus3141.exe
512	bus3141.exe
468	con6381.exe
468	con6381.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	bus3141.exe
Token: SeDebugPrivilege	468	con6381.exe
Token: SeDebugPrivilege	932	deN99s33.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 1340	2216	6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe	84
PID 2216 wrote to memory of 1340	2216	6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe	84
PID 2216 wrote to memory of 1340	2216	6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe	84
PID 1340 wrote to memory of 536	1340	kino8975.exe	86
PID 1340 wrote to memory of 536	1340	kino8975.exe	86
PID 1340 wrote to memory of 536	1340	kino8975.exe	86
PID 536 wrote to memory of 1040	536	kino8972.exe	87
PID 536 wrote to memory of 1040	536	kino8972.exe	87
PID 536 wrote to memory of 1040	536	kino8972.exe	87
PID 1040 wrote to memory of 512	1040	kino1803.exe	89
PID 1040 wrote to memory of 512	1040	kino1803.exe	89
PID 1040 wrote to memory of 468	1040	kino1803.exe	97
PID 1040 wrote to memory of 468	1040	kino1803.exe	97
PID 1040 wrote to memory of 468	1040	kino1803.exe	97
PID 536 wrote to memory of 932	536	kino8972.exe	102
PID 536 wrote to memory of 932	536	kino8972.exe	102
PID 536 wrote to memory of 932	536	kino8972.exe	102

C:\Users\Admin\AppData\Local\Temp\6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe
"C:\Users\Admin\AppData\Local\Temp\6ca7c72cccb293295e23897bab3fc22ec94ad684f1a27d8f243ea6f3eea67022.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8975.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8975.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8972.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8972.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1803.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1803.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3141.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3141.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con6381.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con6381.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 1080
        6⤵
        Program crash
        
        PID:3228
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\deN99s33.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\deN99s33.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 468 -ip 468
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kino8975.exe

Filesize
837KB

MD5
fab1cf694bdfeb3d154ee11cebbdf179

SHA1
98aedcc4d324550f59e4f16dfd2a9b4fe9fdc548

SHA256
1ccd0fdec222731fbd275789b41af0af931ad405289c912b0721ab7da39f802a

SHA512
529b59ee9be6feae661148b7fc71c8a62684b54679b178d0ecff3120b4de3c6d9129c9fbfad4460a007e7985d42da1356660a30f959da32f52dce5098de15ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kino8972.exe

Filesize
694KB

MD5
b5002f4e456c807d11d350ec02a32584

SHA1
77e4e1680e91b65ac6698d7373c87ecdef330705

SHA256
eb3ae48600a7d324a9b48c6f0149b5a4c99386315ac253ec6c336e00fc1d3fe3

SHA512
df1d5ba6d236f00d8a6dcbf602a2edf52ac6bcade9e99979a6aff4dbde074c1c3f75bfdc17b2a4922e331b8ad69544c964c8e15052f7cf021b52b60f49e1edb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\deN99s33.exe

Filesize
391KB

MD5
25bd5152e4b2a0415ade0f8f430ef670

SHA1
e0e3f371daa32ec3371f2d7e916bb7be6f1c009e

SHA256
7ef5203f72925b3b10f2eed21369812c9db8d37657bcd12dd55802a778a7a909

SHA512
9edecfca8b192d0f45ef88464f75199b42aa52cd75177911c7c13770390c9d566c9fb85643da783b462b0c62a2e1ce667fa7b511d3df9b89c0c6f906a4b0d570

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kino1803.exe

Filesize
344KB

MD5
6b6f0ab5c1ba4ebac59aaace01328a66

SHA1
ef83a382a0f08b8a89932c5b29e9883d9657db1b

SHA256
889c5d78ede18d4b210e48c0d5cee5c0fac52fb4a0b89a59d036d58868276e54

SHA512
7822e39f5a1f4fd8be72e2f4e209ab5d947b9a03fd69967a4f365ffe82e83c7c9c57f33cff9a4e9fb06572d3a0c31d864d12cffe009c4faf87b56b4e9b589d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bus3141.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\con6381.exe

Filesize
333KB

MD5
a426855c981ea653ee097235147a7d22

SHA1
ab42bb62e336444b723936a4f0d7377e09e9616a

SHA256
c940a2255b2ec538f6a7b153106a4ea675126851dadad1ac01d79025ced8317a

SHA512
2e1d0523a826ace28da01842ee503a7d1effff8f602442d99796cf2a7e9b80a5e0424beac98bc6c2b79759dd9ffab5a70aa61f1b98bb48b53706c0c2fd2cb7c5

Download Submit
memory/468-46-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-68-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-42-0x0000000004A70000-0x0000000004A8A000-memory.dmp

Filesize
104KB

Download
memory/468-76-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/468-74-0x0000000000400000-0x0000000002B03000-memory.dmp

Filesize
39.0MB

Download
memory/468-72-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-43-0x00000000070D0000-0x0000000007674000-memory.dmp

Filesize
5.6MB

Download
memory/468-44-0x0000000004C60000-0x0000000004C78000-memory.dmp

Filesize
96KB

Download
memory/468-45-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-50-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-70-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-48-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-66-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-64-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-62-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-60-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-58-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-56-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-54-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/468-52-0x0000000004C60000-0x0000000004C72000-memory.dmp

Filesize
72KB

Download
memory/512-32-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/932-96-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-98-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-81-0x00000000049D0000-0x0000000004A16000-memory.dmp

Filesize
280KB

Download
memory/932-993-0x00000000080A0000-0x00000000080EC000-memory.dmp

Filesize
304KB

Download
memory/932-992-0x0000000007F50000-0x0000000007F8C000-memory.dmp

Filesize
240KB

Download
memory/932-991-0x0000000007F30000-0x0000000007F42000-memory.dmp

Filesize
72KB

Download
memory/932-82-0x0000000004C80000-0x0000000004CC4000-memory.dmp

Filesize
272KB

Download
memory/932-108-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-114-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-112-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-110-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-106-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-104-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-102-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-100-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-990-0x0000000007DF0000-0x0000000007EFA000-memory.dmp

Filesize
1.0MB

Download
memory/932-989-0x0000000007750000-0x0000000007D68000-memory.dmp

Filesize
6.1MB

Download
memory/932-94-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-92-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-90-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-88-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-86-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-84-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/932-83-0x0000000004C80000-0x0000000004CBE000-memory.dmp

Filesize
248KB

Download
memory/2216-1-0x0000000004930000-0x0000000004A2A000-memory.dmp

Filesize
1000KB

Download
memory/2216-34-0x0000000004B00000-0x0000000004C00000-memory.dmp

Filesize
1024KB

Download
memory/2216-3-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2216-33-0x0000000004930000-0x0000000004A2A000-memory.dmp

Filesize
1000KB

Download
memory/2216-2-0x0000000004B00000-0x0000000004C00000-memory.dmp

Filesize
1024KB

Download
memory/2216-36-0x0000000000400000-0x0000000000504000-memory.dmp

Filesize
1.0MB

Download
memory/2216-35-0x0000000000400000-0x0000000002BDB000-memory.dmp

Filesize
39.9MB

Download