healer | 461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe
Size

810KB
MD5

affa9612aa79d99bb460679fb2e3df22
SHA1

915f92dc822ea951f51adfa6eebc64590384925a
SHA256

461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d
SHA512

41daac5e4b298b7d55f644bf8018a2ec15a2f649f13603039f1750c5b06389a5ec0f743172fdc3e2f9146b00b208427d6b8783779b823d22fef2250379956e18
SSDEEP

24576:vyYTz4vfC0vLary8NL9unh0/2mjCbdOJ:6YTz4HC0WryS9uh42

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

resource	yara_rule
behavioral1/files/0x000b000000023b8e-19.dat	healer
behavioral1/memory/1144-22-0x0000000000A50000-0x0000000000A5A000-memory.dmp	healer
behavioral1/memory/1152-29-0x0000000002360000-0x000000000237A000-memory.dmp	healer
behavioral1/memory/1152-31-0x0000000002740000-0x0000000002758000-memory.dmp	healer
behavioral1/memory/1152-59-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-58-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-55-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-54-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-51-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-50-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-47-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-45-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-44-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-41-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-39-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-37-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-35-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-33-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/1152-32-0x0000000002740000-0x0000000002752000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b2753jK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b2753jK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b2753jK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c24TN60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b2753jK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b2753jK.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b2753jK.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/1480-67-0x0000000002410000-0x0000000002456000-memory.dmp	family_redline
behavioral1/memory/1480-68-0x00000000050A0000-0x00000000050E4000-memory.dmp	family_redline
behavioral1/memory/1480-72-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-82-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-102-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-100-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-98-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-96-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-94-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-92-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-88-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-87-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-84-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-80-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-78-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-76-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-74-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-90-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-70-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline
behavioral1/memory/1480-69-0x00000000050A0000-0x00000000050DE000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 5 IoCs

pid	Process
4952	nice8060.exe
4164	nice7148.exe
1144	b2753jK.exe
1152	c24TN60.exe
1480	dEfFk90.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b2753jK.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c24TN60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c24TN60.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nice8060.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	nice7148.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4488	1152	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice8060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nice7148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c24TN60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dEfFk90.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1144	b2753jK.exe
1144	b2753jK.exe
1152	c24TN60.exe
1152	c24TN60.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	b2753jK.exe
Token: SeDebugPrivilege	1152	c24TN60.exe
Token: SeDebugPrivilege	1480	dEfFk90.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4952	3600	461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe	84
PID 3600 wrote to memory of 4952	3600	461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe	84
PID 3600 wrote to memory of 4952	3600	461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe	84
PID 4952 wrote to memory of 4164	4952	nice8060.exe	85
PID 4952 wrote to memory of 4164	4952	nice8060.exe	85
PID 4952 wrote to memory of 4164	4952	nice8060.exe	85
PID 4164 wrote to memory of 1144	4164	nice7148.exe	86
PID 4164 wrote to memory of 1144	4164	nice7148.exe	86
PID 4164 wrote to memory of 1152	4164	nice7148.exe	94
PID 4164 wrote to memory of 1152	4164	nice7148.exe	94
PID 4164 wrote to memory of 1152	4164	nice7148.exe	94
PID 4952 wrote to memory of 1480	4952	nice8060.exe	99
PID 4952 wrote to memory of 1480	4952	nice8060.exe	99
PID 4952 wrote to memory of 1480	4952	nice8060.exe	99

C:\Users\Admin\AppData\Local\Temp\461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe
"C:\Users\Admin\AppData\Local\Temp\461fabda57973f84776838eed4d381d12c7f5e2278c69a1e6345ccaa726c993d.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8060.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8060.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice7148.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice7148.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2753jK.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2753jK.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c24TN60.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c24TN60.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1152
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 1036
        5⤵
        Program crash
        
        PID:4488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEfFk90.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEfFk90.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1152 -ip 1152
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice8060.exe

Filesize
665KB

MD5
b44bac1daca29f16194a95713ffe6d08

SHA1
88f53b07959e00a47d6e1a2b41e6f0dbb31d2ac4

SHA256
70956e11e5c36d1b4da094c94d4cc18f8b0608d9ef7f4af3a790b3e367bb0a0b

SHA512
e3629333b21412914b637fe44c1e3d869a11187429ef4a5d0b1612a20cfb705e457c097ce14f30c1a4831d6867903f3c3fd0fa4a9618ecb6115f2ab263ce3f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEfFk90.exe

Filesize
306KB

MD5
434b037af289fae120e4fb8480bfb42c

SHA1
76b729fcbe9d883bbee17e5ca8d76fc04aee3d8f

SHA256
0708f7d381d1a639b56219192bcff33a6177624b7be16103e59e55a6d7a8f99d

SHA512
5433a867fb18dd38402f44336de57365edcb8d0b848e350c1a6c5fc39af6f9364caee612bce8120f1f1af1c45a0d28a23dcbff5006679a2f7964007a46569668

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nice7148.exe

Filesize
332KB

MD5
754c3a2eaac106c3983c5dc0b9c9ab19

SHA1
42221c73ed4ab2b639bfc6e404cb03a769690fdc

SHA256
96bdccc5388f0977117ca924c22e01f52cd69f78085fc16c08428a1fa787f795

SHA512
58b4bc9fe210efe43a48355928ea16a3e0cf1bbdf0b6d7152d55a6c6386b81762119d94a1b61ac48a0f41362042509877ed4ca47abe2bd1fa1f2e4feaff75291

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2753jK.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c24TN60.exe

Filesize
249KB

MD5
73e75c38ae4a49b8db75437acf5ffcc1

SHA1
1e01eab64dc1326cb3ef96fad41f58abd44db2cf

SHA256
7ba7de1832ba129a983bf0551faef469522249e9c7dac96cc131c17503bb5bc6

SHA512
f664b8fda82ddfff920635ca1235c0a34f00a27bfca7fcd80eb63ceb3712e04ab1ec2ecb378d8164c1f9b7016bca7d29ea447260d05c99ad909af99b2453b346

Download Submit
memory/1144-21-0x00007FFA20253000-0x00007FFA20255000-memory.dmp

Filesize
8KB

Download
memory/1144-22-0x0000000000A50000-0x0000000000A5A000-memory.dmp

Filesize
40KB

Download
memory/1144-23-0x00007FFA20253000-0x00007FFA20255000-memory.dmp

Filesize
8KB

Download
memory/1152-60-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1152-31-0x0000000002740000-0x0000000002758000-memory.dmp

Filesize
96KB

Download
memory/1152-59-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-58-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-55-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-54-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-51-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-50-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-47-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-45-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-44-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-41-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-39-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-37-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-35-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-33-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-32-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/1152-30-0x0000000004D00000-0x00000000052A4000-memory.dmp

Filesize
5.6MB

Download
memory/1152-62-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1152-29-0x0000000002360000-0x000000000237A000-memory.dmp

Filesize
104KB

Download
memory/1480-82-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-80-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-72-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-67-0x0000000002410000-0x0000000002456000-memory.dmp

Filesize
280KB

Download
memory/1480-102-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-100-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-98-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-96-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-94-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-92-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-88-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-87-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-84-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-68-0x00000000050A0000-0x00000000050E4000-memory.dmp

Filesize
272KB

Download
memory/1480-78-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-76-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-74-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-90-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-70-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-69-0x00000000050A0000-0x00000000050DE000-memory.dmp

Filesize
248KB

Download
memory/1480-975-0x0000000005100000-0x0000000005718000-memory.dmp

Filesize
6.1MB

Download
memory/1480-976-0x00000000057A0000-0x00000000058AA000-memory.dmp

Filesize
1.0MB

Download
memory/1480-977-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/1480-978-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/1480-979-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download