healer | ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62

Analysis

max time kernel
143s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe
Size

994KB
MD5

1de2d6f06970887c29e31bff52409aeb
SHA1

8a0e8ca87ca091b66a20fa1aa516439031f750c1
SHA256

ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62
SHA512

0ee690085e36871947a69ca7651a9ad24990538dc98d7a34186b12ae9b96edcf96405ecd7ed93d3a2066366a45e26020a84c4349bb43896a16fc70d2e05b9d7f
SSDEEP

24576:9yGpagEeonSUgWojMfFADHCjh3BqFGXsyp3385Mx:Y4ZhoS7WoZDH0LmEsy

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c6e-26.dat	healer
behavioral1/memory/4968-28-0x0000000000410000-0x000000000041A000-memory.dmp	healer
behavioral1/memory/3356-34-0x00000000048A0000-0x00000000048BA000-memory.dmp	healer
behavioral1/memory/3356-36-0x0000000004A50000-0x0000000004A68000-memory.dmp	healer
behavioral1/memory/3356-54-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-64-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-62-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-60-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-59-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-56-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-52-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-51-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-48-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-46-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-44-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-42-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-41-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-37-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3356-38-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v0884Kl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz7280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz7280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz7280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz7280.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v0884Kl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v0884Kl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v0884Kl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz7280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz7280.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v0884Kl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v0884Kl.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1708-72-0x0000000007090000-0x00000000070D6000-memory.dmp	family_redline
behavioral1/memory/1708-73-0x0000000007750000-0x0000000007794000-memory.dmp	family_redline
behavioral1/memory/1708-75-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-91-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-107-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-106-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-103-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-101-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-99-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-97-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-95-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-93-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-89-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-87-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-85-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-83-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-81-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-79-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-77-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline
behavioral1/memory/1708-74-0x0000000007750000-0x000000000778F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
1592	zap3026.exe
1168	zap3631.exe
32	zap7084.exe
4968	tz7280.exe
3356	v0884Kl.exe
1708	w73Ov28.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz7280.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v0884Kl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v0884Kl.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap3631.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap7084.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1900	3356	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap3631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap7084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v0884Kl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w73Ov28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap3026.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4968	tz7280.exe
4968	tz7280.exe
3356	v0884Kl.exe
3356	v0884Kl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	tz7280.exe
Token: SeDebugPrivilege	3356	v0884Kl.exe
Token: SeDebugPrivilege	1708	w73Ov28.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 1592	720	ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe	83
PID 720 wrote to memory of 1592	720	ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe	83
PID 720 wrote to memory of 1592	720	ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe	83
PID 1592 wrote to memory of 1168	1592	zap3026.exe	84
PID 1592 wrote to memory of 1168	1592	zap3026.exe	84
PID 1592 wrote to memory of 1168	1592	zap3026.exe	84
PID 1168 wrote to memory of 32	1168	zap3631.exe	87
PID 1168 wrote to memory of 32	1168	zap3631.exe	87
PID 1168 wrote to memory of 32	1168	zap3631.exe	87
PID 32 wrote to memory of 4968	32	zap7084.exe	88
PID 32 wrote to memory of 4968	32	zap7084.exe	88
PID 32 wrote to memory of 3356	32	zap7084.exe	95
PID 32 wrote to memory of 3356	32	zap7084.exe	95
PID 32 wrote to memory of 3356	32	zap7084.exe	95
PID 1168 wrote to memory of 1708	1168	zap3631.exe	99
PID 1168 wrote to memory of 1708	1168	zap3631.exe	99
PID 1168 wrote to memory of 1708	1168	zap3631.exe	99

C:\Users\Admin\AppData\Local\Temp\ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe
"C:\Users\Admin\AppData\Local\Temp\ab313aa14e927a6f8b74199db37c0bd3184fe906feb9f29c1cf7994ec3aedc62.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:720
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3026.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3026.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3631.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3631.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7084.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7084.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:32
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7280.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7280.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0884Kl.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0884Kl.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1064
        6⤵
        Program crash
        
        PID:1900
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w73Ov28.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w73Ov28.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3356 -ip 3356
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3026.exe

Filesize
809KB

MD5
80b709d959c3f15dd7d61b8f07f135e5

SHA1
56b52cb1d49241798724f79a28c0c54ab58e7d50

SHA256
2142ba7ce6656ddeb9f16c63c9c234696f570c5b2f9540598c07be6137eddd57

SHA512
f2ec8d78496ada0c467939a09e895db660fe4696341d0e23269ab74e62a549716bee179824fec57f7a9870fc2cedd7e93461a9a2e46301725e4fdbd2b2ac8255

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3631.exe

Filesize
667KB

MD5
9980c39b247cf90520bb6c99492c9d58

SHA1
429a24b7ea86a4fa20b327a2ef4652611ee248c7

SHA256
9c9a5fa88099c027d35bf59bbcf936bcf2bcb960e5b9a36eee970c2a0394dd38

SHA512
fb7c085e99181b8a93bd6d43ac09c4ebf9a779ebd2764548f270bb0ff9b98e21de38b77a7b4b6d040fb7381ddbdbe9494da70b46263dd173d84093d677c8810f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w73Ov28.exe

Filesize
342KB

MD5
73a9a34ef6782a0507625cde432eac20

SHA1
4a1ce08a24f08db8a71613f89afe32d25b922c6a

SHA256
962c213780606ea34c2a40f1d18f61889485f16c7a9a4928b825a3b0a007bfe7

SHA512
12344abcc21b390dfccd960d68ca7f69531a0ec3a005fc70e64d762c604f530cbab2d781092048dc6600e6363fcd2b80bc2ff8b6dd330225ab5f00d946c4d7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7084.exe

Filesize
330KB

MD5
4451f3f42d6dea8e96e9f93b31cba96a

SHA1
e17d1b5a14ec18cbe40a1bcc7212b4a1bf6859ef

SHA256
5c013988c3b3af992542cd94fd6926378913e492ab774c3695efcfd3ae2564fd

SHA512
68347036f0f7b4f85a3c27aa35397344bde81c8f1c881b5486be407544178c15a307cf898a3d5964e6955d6cad538fe41aee749e51d014af7e6b709a40f24f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz7280.exe

Filesize
11KB

MD5
0495c2ddffe4fa49800e746fa4bf28a3

SHA1
610d5950b42f0f51307fbcaebbdb818c459f26b0

SHA256
8a2ac20ee9cc1d4cbfbea2f78a9c29fe5a914ebd36e63ca1a3dc922540353564

SHA512
b6216ec5b869af48c0d28b1823bea20208f87ce989c836fc4dbcdb2233491ddefa7192adb68cd9ac48754dac8eac1fe500f678e1e0a35bb0a8b0de30b79e765c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v0884Kl.exe

Filesize
284KB

MD5
4763a9f1048edefd406478341201fa48

SHA1
fa1d688ab6cb4ee0ad334642f7f11f319a07eb21

SHA256
f0cab1594b5e82fba4eb213bc3fb5bc751b137a5b5007a4f543841f06b8c8ae1

SHA512
7d82bd828552443643e198cc88022cd7506a7d29b6f4945fca75ee64c5e8b589ba8d17a9ba7a8f7df361d58d4d0f986b502b182f4e8ad7b308120c9e3b0cdf7f

Download Submit
memory/1708-89-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-87-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-984-0x0000000008110000-0x000000000815C000-memory.dmp

Filesize
304KB

Download
memory/1708-983-0x0000000007FC0000-0x0000000007FFC000-memory.dmp

Filesize
240KB

Download
memory/1708-982-0x0000000007FA0000-0x0000000007FB2000-memory.dmp

Filesize
72KB

Download
memory/1708-981-0x0000000007E60000-0x0000000007F6A000-memory.dmp

Filesize
1.0MB

Download
memory/1708-980-0x00000000077C0000-0x0000000007DD8000-memory.dmp

Filesize
6.1MB

Download
memory/1708-74-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-77-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-79-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-81-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-83-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-85-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-93-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-95-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-97-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-99-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-101-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-103-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-106-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-107-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-72-0x0000000007090000-0x00000000070D6000-memory.dmp

Filesize
280KB

Download
memory/1708-73-0x0000000007750000-0x0000000007794000-memory.dmp

Filesize
272KB

Download
memory/1708-75-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/1708-91-0x0000000007750000-0x000000000778F000-memory.dmp

Filesize
252KB

Download
memory/3356-46-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-48-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-65-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/3356-38-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-37-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-41-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-42-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-44-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-36-0x0000000004A50000-0x0000000004A68000-memory.dmp

Filesize
96KB

Download
memory/3356-35-0x0000000007290000-0x0000000007834000-memory.dmp

Filesize
5.6MB

Download
memory/3356-34-0x00000000048A0000-0x00000000048BA000-memory.dmp

Filesize
104KB

Download
memory/3356-51-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-67-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/3356-52-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-56-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-59-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-60-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-62-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-64-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3356-54-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/4968-28-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download