healer | e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe
Size

787KB
MD5

4c8d7fe864ec9e0b33cb6c8fc4a88ece
SHA1

a5174e9b65d15f10d30f8ea8b10cbbeb0a6fb0d9
SHA256

e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc
SHA512

d8a00b6e0d7b58ed087f75832a9ff1e67e948a120d8688786b85decfb88ff4dcb282b954157f1b80f998a8653ed74c6573be1ce7603940a40618480f8ea1853e
SSDEEP

12288:zMr2y90nip5eFLKvRmgskA+LJvYzSN8hdleL6sa3sc1sVqMumo63YtEOrsIU8f:9yFApSskLJSt/eLFa3swQu0YaOoX6

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3300-19-0x0000000002570000-0x000000000258A000-memory.dmp	healer
behavioral1/memory/3300-21-0x00000000025F0000-0x0000000002608000-memory.dmp	healer
behavioral1/memory/3300-27-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-49-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-47-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-46-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-44-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-41-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-39-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-37-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-35-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-33-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-31-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-29-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-23-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-22-0x00000000025F0000-0x0000000002602000-memory.dmp	healer
behavioral1/memory/3300-25-0x00000000025F0000-0x0000000002602000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro1772.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro1772.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1108-2142-0x00000000026F0000-0x0000000002722000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/2980-2155-0x0000000000B60000-0x0000000000B90000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570306.exe	family_redline
behavioral1/memory/5260-2166-0x00000000002C0000-0x00000000002EE000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu2260.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation qu2260.exe
Executes dropped EXE 5 IoCs

Processes:

un570418.exepro1772.exequ2260.exe1.exesi570306.exe

pid process

2172 un570418.exe
3300 pro1772.exe
1108 qu2260.exe
2980 1.exe
5260 si570306.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	qu2260.exe

pid	process
2172	un570418.exe
3300	pro1772.exe
1108	qu2260.exe
2980	1.exe
5260	si570306.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro1772.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro1772.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro1772.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exeun570418.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un570418.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4380 3300 WerFault.exe pro1772.exe
1820 1108 WerFault.exe qu2260.exe

pid	pid_target	process	target process
4380	3300	WerFault.exe	pro1772.exe
1820	1108	WerFault.exe	qu2260.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

un570418.exepro1772.exequ2260.exe1.exesi570306.exee7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un570418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro1772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu2260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si570306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro1772.exe

pid process

3300 pro1772.exe
3300 pro1772.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro1772.exequ2260.exe

description pid process

Token: SeDebugPrivilege 3300 pro1772.exe
Token: SeDebugPrivilege 1108 qu2260.exe

pid	process
3300	pro1772.exe
3300	pro1772.exe

description	pid	process
Token: SeDebugPrivilege	3300	pro1772.exe
Token: SeDebugPrivilege	1108	qu2260.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exeun570418.exequ2260.exe

description	pid	process	target process
PID 1552 wrote to memory of 2172	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	un570418.exe
PID 1552 wrote to memory of 2172	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	un570418.exe
PID 1552 wrote to memory of 2172	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	un570418.exe
PID 2172 wrote to memory of 3300	2172	un570418.exe	pro1772.exe
PID 2172 wrote to memory of 3300	2172	un570418.exe	pro1772.exe
PID 2172 wrote to memory of 3300	2172	un570418.exe	pro1772.exe
PID 2172 wrote to memory of 1108	2172	un570418.exe	qu2260.exe
PID 2172 wrote to memory of 1108	2172	un570418.exe	qu2260.exe
PID 2172 wrote to memory of 1108	2172	un570418.exe	qu2260.exe
PID 1108 wrote to memory of 2980	1108	qu2260.exe	1.exe
PID 1108 wrote to memory of 2980	1108	qu2260.exe	1.exe
PID 1108 wrote to memory of 2980	1108	qu2260.exe	1.exe
PID 1552 wrote to memory of 5260	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	si570306.exe
PID 1552 wrote to memory of 5260	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	si570306.exe
PID 1552 wrote to memory of 5260	1552	e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe	si570306.exe

C:\Users\Admin\AppData\Local\Temp\e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe
"C:\Users\Admin\AppData\Local\Temp\e7b1bf4a69f89d4a3e950cb1eba196e5c21953a2d7d05417148b93bddd5a57dc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un570418.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un570418.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1772.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1772.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3300 -s 1080
4⤵
- Program crash
PID:4380

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2260.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2260.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 1464
4⤵
- Program crash
PID:1820

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570306.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570306.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3300 -ip 3300
1⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1108 -ip 1108
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si570306.exe

Filesize
168KB

MD5
f3a94f4ac499dc5e598a032a30f7b589

SHA1
d2d322c80e6976836231ba628d0cf83420cd4155

SHA256
a686d43fe77402c9a211df4afb326d99cde8d30088e5e1c7026bcf2929dd2638

SHA512
351cb345587717b9152513be161b0822dcfd3707a5cfd5d2e1eeb8640ee5eca8661416cb1af43ea9d2f429ded556fd83e83b56c466842c7df0f34349e1e5435a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un570418.exe

Filesize
633KB

MD5
d03a9f673d1e192a45714fc7a068c46a

SHA1
1dfde1844cea4481b33c27ca048702cd5b489fcc

SHA256
00703d396c52cfea22c46b591045ceb5c07b7590564aae90140969820c7b3bb3

SHA512
f78e3338f47d4e9aa2f3e276339d51f64d71e3dd2eac5de7dafe682aa970291b74ef55cbb51d1935be4f126bb2dfa851af659493a2a01f89dd79bc4b47fbf3b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1772.exe

Filesize
230KB

MD5
762b8a8b11ee8d66100ff14c5d1affed

SHA1
a08cb585c3948c970e757dfe25c24c7b6f93e8b9

SHA256
ba1e56687a83b2e7c00b73f197fb816f2a276f4fdc32c14ac3b363aacee4786b

SHA512
4f594e8d78a5bc3f385c683e62aa4445a51e2ee6040334c468a9085f6152c165c52ffb59ebbf6602cefda53cdee1e7169a8c1ea5443447e4f87ba7b6d5b96155

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2260.exe

Filesize
414KB

MD5
7a688cfb9d83a7b7be495a14b4791b9d

SHA1
5e71850aebcdf39318f30138d25e8bb7f8582ff8

SHA256
bf2ef771d78677006545280bd7718b43d87ede1932d7855f768ac91d9e32f61a

SHA512
9630629fb087df84ef341da9a4a5008d93afe287d31f3b7535c6a0fdfd181beb2b44fbbc04347bc05860eef7f9a23a0b88a5f3e33395682161997c6441ff2124

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1108-73-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-60-0x00000000023D0000-0x0000000002436000-memory.dmp

Filesize
408KB

Download
memory/1108-93-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-87-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-2142-0x00000000026F0000-0x0000000002722000-memory.dmp

Filesize
200KB

Download
memory/1108-65-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-67-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-69-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-75-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-77-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-79-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-81-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-83-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-71-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-90-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-91-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-95-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-62-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-63-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-85-0x00000000024D0000-0x000000000252F000-memory.dmp

Filesize
380KB

Download
memory/1108-61-0x00000000024D0000-0x0000000002536000-memory.dmp

Filesize
408KB

Download
memory/2980-2165-0x00000000056C0000-0x000000000570C000-memory.dmp

Filesize
304KB

Download
memory/2980-2155-0x0000000000B60000-0x0000000000B90000-memory.dmp

Filesize
192KB

Download
memory/2980-2159-0x00000000054E0000-0x00000000054F2000-memory.dmp

Filesize
72KB

Download
memory/2980-2158-0x00000000055B0000-0x00000000056BA000-memory.dmp

Filesize
1.0MB

Download
memory/2980-2157-0x0000000005A90000-0x00000000060A8000-memory.dmp

Filesize
6.1MB

Download
memory/2980-2156-0x0000000005240000-0x0000000005246000-memory.dmp

Filesize
24KB

Download
memory/2980-2160-0x0000000005540000-0x000000000557C000-memory.dmp

Filesize
240KB

Download
memory/3300-22-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-46-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-55-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3300-23-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-29-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-31-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-33-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-35-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-37-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-39-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-41-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-44-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3300-25-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-47-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-49-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-27-0x00000000025F0000-0x0000000002602000-memory.dmp

Filesize
72KB

Download
memory/3300-16-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3300-50-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/3300-19-0x0000000002570000-0x000000000258A000-memory.dmp

Filesize
104KB

Download
memory/3300-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3300-54-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3300-18-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3300-21-0x00000000025F0000-0x0000000002608000-memory.dmp

Filesize
96KB

Download
memory/3300-15-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/3300-20-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/5260-2166-0x00000000002C0000-0x00000000002EE000-memory.dmp

Filesize
184KB

Download
memory/5260-2167-0x00000000024A0000-0x00000000024A6000-memory.dmp

Filesize
24KB

Download