healer | 3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e

Analysis

max time kernel
113s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe
Size

807KB
MD5

b5aa1adb4dae342eb835fb9e202adda5
SHA1

07ac7addaa7711d95df51fe5e365c85f58409c07
SHA256

3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e
SHA512

3d5fd1d4c19a41822352af5e571b7f7b8457acfbaa2a507862ef9d9b4905cc974ca2e31a85df50097050ffcc6f5ae6ce6604c42da54876b261afb3595019c11f
SSDEEP

24576:cyaUl8Fn1TuJdKGNg0v/wdK2d/Nw/2WOp4:L01SJ3HwdK2HwOWOe

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023c93-19.dat	healer
behavioral1/memory/4400-22-0x00000000008D0000-0x00000000008DA000-memory.dmp	healer
behavioral1/memory/2976-29-0x0000000004A10000-0x0000000004A2A000-memory.dmp	healer
behavioral1/memory/2976-31-0x0000000004BC0000-0x0000000004BD8000-memory.dmp	healer
behavioral1/memory/2976-57-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-59-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-55-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-53-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-51-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-49-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-47-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-45-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-43-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-41-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-39-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-37-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-35-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-33-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer
behavioral1/memory/2976-32-0x0000000004BC0000-0x0000000004BD2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v3958Xn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz7114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz7114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz7114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz7114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v3958Xn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v3958Xn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v3958Xn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz7114.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz7114.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v3958Xn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v3958Xn.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/5036-68-0x0000000004D00000-0x0000000004D44000-memory.dmp	family_redline
behavioral1/memory/5036-67-0x0000000004AF0000-0x0000000004B36000-memory.dmp	family_redline
behavioral1/memory/5036-88-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-98-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-102-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-100-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-96-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-94-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-92-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-90-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-86-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-84-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-83-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-81-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-78-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-76-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-74-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-72-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-70-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline
behavioral1/memory/5036-69-0x0000000004D00000-0x0000000004D3F000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
1048	zap0057.exe
3556	zap1805.exe
4400	tz7114.exe
2976	v3958Xn.exe
5036	w20hY07.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz7114.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v3958Xn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v3958Xn.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap0057.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1805.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1088	2976	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap0057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zap1805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	v3958Xn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w20hY07.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4400	tz7114.exe
4400	tz7114.exe
2976	v3958Xn.exe
2976	v3958Xn.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	tz7114.exe
Token: SeDebugPrivilege	2976	v3958Xn.exe
Token: SeDebugPrivilege	5036	w20hY07.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1048	1052	3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe	84
PID 1052 wrote to memory of 1048	1052	3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe	84
PID 1052 wrote to memory of 1048	1052	3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe	84
PID 1048 wrote to memory of 3556	1048	zap0057.exe	85
PID 1048 wrote to memory of 3556	1048	zap0057.exe	85
PID 1048 wrote to memory of 3556	1048	zap0057.exe	85
PID 3556 wrote to memory of 4400	3556	zap1805.exe	86
PID 3556 wrote to memory of 4400	3556	zap1805.exe	86
PID 3556 wrote to memory of 2976	3556	zap1805.exe	97
PID 3556 wrote to memory of 2976	3556	zap1805.exe	97
PID 3556 wrote to memory of 2976	3556	zap1805.exe	97
PID 1048 wrote to memory of 5036	1048	zap0057.exe	102
PID 1048 wrote to memory of 5036	1048	zap0057.exe	102
PID 1048 wrote to memory of 5036	1048	zap0057.exe	102

C:\Users\Admin\AppData\Local\Temp\3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe
"C:\Users\Admin\AppData\Local\Temp\3f7737e2fcd58096c064623ae35186afd664a4486878b1676f0249cec810bf5e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0057.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0057.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1805.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1805.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tz7114.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tz7114.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3958Xn.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3958Xn.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 1084
        5⤵
        Program crash
        
        PID:1088
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w20hY07.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w20hY07.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2976 -ip 2976
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0057.exe

Filesize
665KB

MD5
d50e646113d87d93b1f392605256858d

SHA1
514f2716cacc1126503d7f4a071cff856ebbc824

SHA256
6396cd2cc30701b7a9f5bd7077c3fccdcec808bd7222d2a447e3e9a5020090c6

SHA512
b4cfd4833c1ff1934a3336769f13fa5f0a31d616b38a60e9e329777a5680ba782ec8a95d052a18aeed7507e25f7deb1fd95f5a542d2c76b99bd198bb15f7d8b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w20hY07.exe

Filesize
342KB

MD5
c23420479dad166ff9b3e01cf75777f6

SHA1
8159126c064ef4691aab26d89cace1bf128fd994

SHA256
9cecaa5c0f9decad664745c7ad7f74ab54923abefdd08567757309517e1096d5

SHA512
ca7a07788594dc8603376f7a7f688602098987eb78b2888eb82e3a511253d0f7f2aa888cf944b026597f802eaa3fe2a7cd76877abfe3798ebfc3748c6ed167a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1805.exe

Filesize
329KB

MD5
aa013c2d51d9ec1110a35b5e69466b91

SHA1
0661ca282d61d2e06e34bd56144a6a0a428c8d9d

SHA256
2377e26ca3df363c847a786b34858e98cdecca922328f284f5a8118e4f8729b9

SHA512
60fea4c7b36c812ebf9d90d57c8a4f80d58fdda1a19345d89b56330bc98ebe3bfd8434363b2d89b7cff17753ac9ac2d1c60f960d4a6aad1e29048512ab2394cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tz7114.exe

Filesize
11KB

MD5
6aa5e2fb425fb5ab3897afb250651a85

SHA1
e20a242e8afddaebc355efa71ab0b0162bd88721

SHA256
09cad1cef24fa0f78dbf75286070679ca58c3b6eb68869a8168b812f09a68cf7

SHA512
2207fe388703f4f0a9c3dcd86bbd2b15cd05ed0cfc6f7523417002bcf8fd60b095600dbd72f4071d7efb721e2d12dff6439b33ee595937922f73f25fb289ea72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3958Xn.exe

Filesize
284KB

MD5
b872fcc2f3285b82c25d3ef4f4b13901

SHA1
9982d03bc2e76a8ae49b9247e5e72401d4af28fb

SHA256
73961d777a3a8871fccccb5a550b666937e47a140bc1881a16c866fe17cef05a

SHA512
94378362c36725a5da5aee6987d0b96a3fc083be6ca72db94dd5e56d41e05a86e4aa5f36925ed394480f6fa5b09e9e7d50fc795d8d2cc0f883f172ad84627052

Download Submit
memory/2976-60-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2976-47-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-29-0x0000000004A10000-0x0000000004A2A000-memory.dmp

Filesize
104KB

Download
memory/2976-30-0x00000000071F0000-0x0000000007794000-memory.dmp

Filesize
5.6MB

Download
memory/2976-31-0x0000000004BC0000-0x0000000004BD8000-memory.dmp

Filesize
96KB

Download
memory/2976-57-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-59-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-55-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-53-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-51-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-49-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-41-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-45-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-43-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-62-0x0000000000400000-0x0000000002B75000-memory.dmp

Filesize
39.5MB

Download
memory/2976-39-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-37-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-35-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-33-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2976-32-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/4400-22-0x00000000008D0000-0x00000000008DA000-memory.dmp

Filesize
40KB

Download
memory/4400-21-0x00007FFDDE353000-0x00007FFDDE355000-memory.dmp

Filesize
8KB

Download
memory/4400-23-0x00007FFDDE353000-0x00007FFDDE355000-memory.dmp

Filesize
8KB

Download
memory/5036-69-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-90-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-88-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-98-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-102-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-100-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-96-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-94-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-92-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-67-0x0000000004AF0000-0x0000000004B36000-memory.dmp

Filesize
280KB

Download
memory/5036-86-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-84-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-83-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-81-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-78-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-76-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-74-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-72-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-70-0x0000000004D00000-0x0000000004D3F000-memory.dmp

Filesize
252KB

Download
memory/5036-68-0x0000000004D00000-0x0000000004D44000-memory.dmp

Filesize
272KB

Download
memory/5036-975-0x00000000077E0000-0x0000000007DF8000-memory.dmp

Filesize
6.1MB

Download
memory/5036-976-0x0000000007E50000-0x0000000007F5A000-memory.dmp

Filesize
1.0MB

Download
memory/5036-977-0x0000000007F90000-0x0000000007FA2000-memory.dmp

Filesize
72KB

Download
memory/5036-978-0x0000000007FB0000-0x0000000007FEC000-memory.dmp

Filesize
240KB

Download
memory/5036-979-0x0000000008100000-0x000000000814C000-memory.dmp

Filesize
304KB

Download