healer | 1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe
Size

1.0MB
MD5

37f6da1c0f7fc8ad37126c689b93e4ea
SHA1

23582b974753f06bb99e4ac348671ace50a39d4b
SHA256

1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0
SHA512

b51c3904767400f9b3f3c83c7622dd099cb00ccf74b23d902786cff8ab66ee684f19f8c193a2414897e1de128e2d1ce51e6e6c2645cb353db5b0c5b7a7153b5e
SSDEEP

24576:hy+nJSVEbXwuPFJ3mqDcyH4VEzZCTxqpGmz9:UmJsErwsD2Sc04SsTxuG

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b8c-27.dat	healer
behavioral1/memory/4580-28-0x0000000000460000-0x000000000046A000-memory.dmp	healer
behavioral1/memory/336-34-0x0000000002600000-0x000000000261A000-memory.dmp	healer
behavioral1/memory/336-36-0x0000000002830000-0x0000000002848000-memory.dmp	healer
behavioral1/memory/336-37-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-64-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-62-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-60-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-58-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-56-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-52-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-51-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-48-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-46-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-44-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-42-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-40-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-38-0x0000000002830000-0x0000000002842000-memory.dmp	healer
behavioral1/memory/336-54-0x0000000002830000-0x0000000002842000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz4408.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v8161Yz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v8161Yz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v8161Yz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz4408.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz4408.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz4408.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v8161Yz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v8161Yz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz4408.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz4408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v8161Yz.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1120-72-0x00000000027D0000-0x0000000002816000-memory.dmp	family_redline
behavioral1/memory/1120-73-0x0000000004E20000-0x0000000004E64000-memory.dmp	family_redline
behavioral1/memory/1120-89-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-79-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-77-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-75-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-74-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-101-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-105-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-103-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-99-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-97-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-95-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-93-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-91-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-87-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-85-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-83-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-81-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline
behavioral1/memory/1120-107-0x0000000004E20000-0x0000000004E5F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

pid	Process
4092	zap3378.exe
1156	zap9220.exe
3972	zap0165.exe
4580	tz4408.exe
336	v8161Yz.exe
1120	w09sz02.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz4408.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v8161Yz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v8161Yz.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap3378.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap9220.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0165.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	336	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap3378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap9220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap0165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v8161Yz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w09sz02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4580	tz4408.exe
4580	tz4408.exe
336	v8161Yz.exe
336	v8161Yz.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	tz4408.exe
Token: SeDebugPrivilege	336	v8161Yz.exe
Token: SeDebugPrivilege	1120	w09sz02.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4092	4424	1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe	85
PID 4424 wrote to memory of 4092	4424	1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe	85
PID 4424 wrote to memory of 4092	4424	1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe	85
PID 4092 wrote to memory of 1156	4092	zap3378.exe	86
PID 4092 wrote to memory of 1156	4092	zap3378.exe	86
PID 4092 wrote to memory of 1156	4092	zap3378.exe	86
PID 1156 wrote to memory of 3972	1156	zap9220.exe	88
PID 1156 wrote to memory of 3972	1156	zap9220.exe	88
PID 1156 wrote to memory of 3972	1156	zap9220.exe	88
PID 3972 wrote to memory of 4580	3972	zap0165.exe	89
PID 3972 wrote to memory of 4580	3972	zap0165.exe	89
PID 3972 wrote to memory of 336	3972	zap0165.exe	96
PID 3972 wrote to memory of 336	3972	zap0165.exe	96
PID 3972 wrote to memory of 336	3972	zap0165.exe	96
PID 1156 wrote to memory of 1120	1156	zap9220.exe	103
PID 1156 wrote to memory of 1120	1156	zap9220.exe	103
PID 1156 wrote to memory of 1120	1156	zap9220.exe	103

C:\Users\Admin\AppData\Local\Temp\1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe
"C:\Users\Admin\AppData\Local\Temp\1bb567889b8fed662a357a93569be14966f8799c2bb5afc2552c39272a0d27b0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3378.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3378.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9220.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9220.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0165.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0165.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4408.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4408.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8161Yz.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8161Yz.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:336
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 1096
        6⤵
        Program crash
        
        PID:972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09sz02.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09sz02.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 336 -ip 336
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3378.exe

Filesize
848KB

MD5
da97468d7c75b35a397a99a4ca97a80a

SHA1
85240be4988dcca77b79fde9db3d1f0d0ec417ed

SHA256
7741b47a0a8f7e4343dfa7da8c9ce353b42c15e0014ef4968759202bd0300f1a

SHA512
fe149a532d5e18af4f9a906ead379673b85334221e40f5ac4fd71ed988cbe029b038cc76229ed1fb68bba9a3d2d806d6c6ae4a554ddb4c2a9994d8e12b863cfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9220.exe

Filesize
706KB

MD5
e05ae5113fdf06f885d78ca64a19d142

SHA1
28d116b6c6b0307d9d479f053599b04acb1a005e

SHA256
9fc5a9d0cd7ec9b04b27d0338d1de76337317757b668a09642eba4442d4da45c

SHA512
ea360b08a0012b9e0c7824eebe85bef317c5a9e336e07db01dcf5216fe37f209bda75b68bcf30c6c386926398de7914942033d1e7798baf876dbc7c2b8a99d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w09sz02.exe

Filesize
411KB

MD5
50aebb55200ad01751053c3791c62a5c

SHA1
63b18f1055733944ab4fe111232663e1423efe78

SHA256
9a1cb15870e4601967f4445bdf7d4fd4a405084f7ff6a0a21c84ca97f2f8309a

SHA512
9d23a1844e6ae16132e6a0e4b91080647c1174aa621f2c9cf7e39dc778955dd4674680af89ecbf97e2a88d3ff2b461c729ef26a8111c867d9780c3ef77a69d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0165.exe

Filesize
349KB

MD5
4b759003c5bd932ae5255254c31ac0e5

SHA1
654be7e459c700704acd3149c45210e902066249

SHA256
93a0e38191a2f84d16a6b48904d0473673ae0275674db6aaba1e1a891c7e55cf

SHA512
1dba7b961d2aaa8329bf992b03f8427cd33a35313db663b8a0018c1e8594a278e4ef585b0f837152d72a050e1ba7f0231235336569f7eb4474281aea630a0f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz4408.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8161Yz.exe

Filesize
352KB

MD5
57514e803fd1e9a8a78a5447d96d80c5

SHA1
934f618765bfc5b4674d339f7b15615ac5b6fa46

SHA256
124ba5f15749eb7967fd5576baa4baaa85647efe41ffd687b779ed1b8f292556

SHA512
e3d57c04faa30cf533af84497ed84154c8e1d054846bd18b0f81ae17a3a5241a4fe86fb5fd4672614d6ba5f1b22625b7d9aff518740e4974473f451126186143

Download Submit
memory/336-67-0x0000000000400000-0x00000000007F7000-memory.dmp

Filesize
4.0MB

Download
memory/336-35-0x0000000004EC0000-0x0000000005464000-memory.dmp

Filesize
5.6MB

Download
memory/336-36-0x0000000002830000-0x0000000002848000-memory.dmp

Filesize
96KB

Download
memory/336-37-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-64-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-62-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-60-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-58-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-56-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-52-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-51-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-48-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-46-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-44-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-42-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-40-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-38-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-54-0x0000000002830000-0x0000000002842000-memory.dmp

Filesize
72KB

Download
memory/336-65-0x0000000000400000-0x00000000007F7000-memory.dmp

Filesize
4.0MB

Download
memory/336-34-0x0000000002600000-0x000000000261A000-memory.dmp

Filesize
104KB

Download
memory/1120-89-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-95-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-73-0x0000000004E20000-0x0000000004E64000-memory.dmp

Filesize
272KB

Download
memory/1120-984-0x0000000005D90000-0x0000000005DDC000-memory.dmp

Filesize
304KB

Download
memory/1120-79-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-77-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-75-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-74-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-101-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-105-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-103-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-99-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-97-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-72-0x00000000027D0000-0x0000000002816000-memory.dmp

Filesize
280KB

Download
memory/1120-93-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-91-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-87-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-85-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-83-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-81-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-107-0x0000000004E20000-0x0000000004E5F000-memory.dmp

Filesize
252KB

Download
memory/1120-980-0x0000000005500000-0x0000000005B18000-memory.dmp

Filesize
6.1MB

Download
memory/1120-981-0x0000000005B20000-0x0000000005C2A000-memory.dmp

Filesize
1.0MB

Download
memory/1120-982-0x0000000005C30000-0x0000000005C42000-memory.dmp

Filesize
72KB

Download
memory/1120-983-0x0000000005C50000-0x0000000005C8C000-memory.dmp

Filesize
240KB

Download
memory/4580-28-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download