healer | 81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5e

Analysis

max time kernel
112s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe
Size

987KB
MD5

e3fe8cd7d72cfa064c8534504a3f8850
SHA1

905bf1d31e9b80e190db30985a2902d2348db643
SHA256

81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5e
SHA512

94814981a684d602cbdfccffa368c4c570ea72732e2d3026fef99790a45c7c922dac3bd56d9f81ccad3fc3d7a2e8bd9f7dd60d12c508c742141641285b27b122
SSDEEP

24576:FyXzCt7blUDsaU/gGRpzQbL7VzV5hjNaMRvnW+tFhRSve:gXzCtNPoGRpz2LpzH+kvnW+tFh

Score

10^/10

healer redline rosn discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023cc5-26.dat	healer
behavioral1/memory/1924-28-0x00000000003F0000-0x00000000003FA000-memory.dmp	healer
behavioral1/memory/3276-34-0x0000000002390000-0x00000000023AA000-memory.dmp	healer
behavioral1/memory/3276-36-0x0000000004A50000-0x0000000004A68000-memory.dmp	healer
behavioral1/memory/3276-37-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-54-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-64-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-62-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-60-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-58-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-56-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-52-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-50-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-48-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-46-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-44-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-42-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-40-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/3276-38-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

bu082085.execor5708.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	bu082085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	bu082085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	bu082085.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor5708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor5708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor5708.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	bu082085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	bu082085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	bu082085.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor5708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor5708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor5708.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4248-72-0x00000000049F0000-0x0000000004A36000-memory.dmp	family_redline
behavioral1/memory/4248-73-0x0000000004A90000-0x0000000004AD4000-memory.dmp	family_redline
behavioral1/memory/4248-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-107-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-105-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-101-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-97-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-93-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-103-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-100-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline
behavioral1/memory/4248-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 6 IoCs

Processes:

kina1723.exekina2212.exekina5937.exebu082085.execor5708.exedcA33s01.exe

pid	Process
4984	kina1723.exe
4196	kina2212.exe
4876	kina5937.exe
1924	bu082085.exe
3276	cor5708.exe
4248	dcA33s01.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

bu082085.execor5708.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	bu082085.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor5708.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor5708.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

kina5937.exe81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exekina1723.exekina2212.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina5937.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina1723.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina2212.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
3360	3276	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

kina5937.execor5708.exedcA33s01.exe81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exekina1723.exekina2212.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina5937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cor5708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcA33s01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina1723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kina2212.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bu082085.execor5708.exe

pid	Process
1924	bu082085.exe
1924	bu082085.exe
3276	cor5708.exe
3276	cor5708.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bu082085.execor5708.exedcA33s01.exe

description	pid	Process
Token: SeDebugPrivilege	1924	bu082085.exe
Token: SeDebugPrivilege	3276	cor5708.exe
Token: SeDebugPrivilege	4248	dcA33s01.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exekina1723.exekina2212.exekina5937.exe

description	pid	Process	procid_target
PID 2376 wrote to memory of 4984	2376	81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe	83
PID 2376 wrote to memory of 4984	2376	81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe	83
PID 2376 wrote to memory of 4984	2376	81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe	83
PID 4984 wrote to memory of 4196	4984	kina1723.exe	84
PID 4984 wrote to memory of 4196	4984	kina1723.exe	84
PID 4984 wrote to memory of 4196	4984	kina1723.exe	84
PID 4196 wrote to memory of 4876	4196	kina2212.exe	85
PID 4196 wrote to memory of 4876	4196	kina2212.exe	85
PID 4196 wrote to memory of 4876	4196	kina2212.exe	85
PID 4876 wrote to memory of 1924	4876	kina5937.exe	86
PID 4876 wrote to memory of 1924	4876	kina5937.exe	86
PID 4876 wrote to memory of 3276	4876	kina5937.exe	88
PID 4876 wrote to memory of 3276	4876	kina5937.exe	88
PID 4876 wrote to memory of 3276	4876	kina5937.exe	88
PID 4196 wrote to memory of 4248	4196	kina2212.exe	93
PID 4196 wrote to memory of 4248	4196	kina2212.exe	93
PID 4196 wrote to memory of 4248	4196	kina2212.exe	93

C:\Users\Admin\AppData\Local\Temp\81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe
"C:\Users\Admin\AppData\Local\Temp\81f00a27bb2980d7bc963726f97567bec236a3c4ab1e09c5c44d6b9b5928bf5eN.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1723.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1723.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2212.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2212.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5937.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5937.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu082085.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu082085.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5708.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5708.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3276
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 1064
        6⤵
        Program crash
        
        PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcA33s01.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcA33s01.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3276 -ip 3276
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina1723.exe

Filesize
803KB

MD5
b6c6d3c486c5b6a8965a37a2c3a9ccb1

SHA1
c5677518340a48ae30fa764f760c3329b00f9483

SHA256
772194b3495526ed9e273f5d04a252d72eb3678f2098e7557c15c5d2d0fe6d25

SHA512
7544973029e3559f69e88cfe18cd1ed1e42cd9c3076f70ebf6cc5701247f7afd5164d43b87da542a095bb62536f4a44e49fd7f245ce7f994003b645393ee734c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina2212.exe

Filesize
650KB

MD5
806a5084b74d1c17b4693e16845f1795

SHA1
7f95510b432f37ec5ced605732bf9ee2156fc526

SHA256
ae60ad8dd78b1cbf6981b764b9bbd03398bb8212e291f3aaacc78ec4f842c2cb

SHA512
b6c97719e5689a42e1b5aefa221f04372687edb21da88e97eb51460d5f5e1ca04a46f2bb1a43412547852215da50505e8db3f04d19c5c603b113d267476b4142

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dcA33s01.exe

Filesize
295KB

MD5
287646e9bafca0eccfa2e51a1948269d

SHA1
5cc7fc90bea0209c59bf439e7b46c1170db048fc

SHA256
ed8fd1566a8559c6694826795f05e6da16dda0098bcdbde3dd9ff65434ddd845

SHA512
d27d36ddc1c6b705e0a822ed6dfbeb217004f6224da97d6a278e7898a0f28ec0267b6cf8cd8c32d9c5a538930c19a883ead1ae4ba9902f7ef1b49caa0484d0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina5937.exe

Filesize
321KB

MD5
35730def6f2a0af22cc35084df9d2b48

SHA1
3a9b879c666ba88f85de12d320623145cca5065b

SHA256
02b1dd1e52250644ee000a8a91c537d3c327e57654301219b22d9474a0bee88d

SHA512
69abda7e44bd804f0592a3d421b275dde2c2b2e28d9048fdeaa481fd4331ab649a123d57b0c1c2fa7e29dc93d23d2742a2e9fcc405d8de6d782f98f0c3fa709d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu082085.exe

Filesize
15KB

MD5
f3d1bfd0bd36d3e64875f927fb93e1c0

SHA1
c35ec77e40cd7377bb073c84baf7bf94242cfc9c

SHA256
8d37643861324aa045fec5d0e3d48d0205a72a5980cda059e2f78ae1232c49e1

SHA512
41746304c070b4241c36684adbd3b12ccc894b3f6d820b6986a371bfaae5ee0086238f69faab470c4e284e20c387efd505a05cd7886325f873c28619bc17f1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\cor5708.exe

Filesize
237KB

MD5
b6ffbda723c381bee6525089317fe433

SHA1
733a3ccc321a6df315576df93436ffa886025bb8

SHA256
a200233c2e89d1a40763ab1bbf1be2a44a5f21299fff26a3e0687809833a34dc

SHA512
9b7cac38fb27c89e00f50c9cce9cdd08b3978bbeff21151a4287221114833c32139264e9208deb5e8ddf6df8c4f3b26a709389814cca5f36d102924adf99c547

Download Submit
memory/1924-28-0x00000000003F0000-0x00000000003FA000-memory.dmp

Filesize
40KB

Download
memory/3276-67-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3276-36-0x0000000004A50000-0x0000000004A68000-memory.dmp

Filesize
96KB

Download
memory/3276-37-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-54-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-64-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-62-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-60-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-58-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-56-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-52-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-50-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-48-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-46-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-44-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-42-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-40-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-38-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/3276-65-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/3276-35-0x0000000004B70000-0x0000000005114000-memory.dmp

Filesize
5.6MB

Download
memory/3276-34-0x0000000002390000-0x00000000023AA000-memory.dmp

Filesize
104KB

Download
memory/4248-87-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-81-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-83-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-72-0x00000000049F0000-0x0000000004A36000-memory.dmp

Filesize
280KB

Download
memory/4248-107-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-105-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-101-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-97-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-95-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-93-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-91-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-89-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-85-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-73-0x0000000004A90000-0x0000000004AD4000-memory.dmp

Filesize
272KB

Download
memory/4248-103-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-100-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-79-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-77-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-75-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-74-0x0000000004A90000-0x0000000004ACF000-memory.dmp

Filesize
252KB

Download
memory/4248-980-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/4248-981-0x0000000005790000-0x000000000589A000-memory.dmp

Filesize
1.0MB

Download
memory/4248-982-0x00000000058D0000-0x00000000058E2000-memory.dmp

Filesize
72KB

Download
memory/4248-983-0x00000000058F0000-0x000000000592C000-memory.dmp

Filesize
240KB

Download
memory/4248-984-0x0000000005A40000-0x0000000005A8C000-memory.dmp

Filesize
304KB

Download