healer | 39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe
Size

789KB
MD5

9bc0784541f3445b3988c6662d94d051
SHA1

de586db06e7a695b2317aefb008478ae03e48553
SHA256

39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971
SHA512

69718423a0e540ead4c526968fa669353245fb6bb208bedf7b97381f67ded926040aed743e2df51314b67f08873603cdd482c6bd7f5d5f4aec6775212cd88577
SSDEEP

12288:KMrcy90xHWJSgWiFWGH/wIQqiHFxzfB4Wi4moBo7D1mxZlaOOeZVN:Sy+W/WXGDQqiHF1fB4Wi4mZ1mzlaOOC

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4032-19-0x00000000022F0000-0x000000000230A000-memory.dmp	healer
behavioral1/memory/4032-21-0x0000000002580000-0x0000000002598000-memory.dmp	healer
behavioral1/memory/4032-27-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-29-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-49-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-48-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-45-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-44-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-41-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-39-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-37-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-35-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-33-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-31-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-25-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-23-0x0000000002580000-0x0000000002592000-memory.dmp	healer
behavioral1/memory/4032-22-0x0000000002580000-0x0000000002592000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro6317.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6317.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6317.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6317.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2900-2143-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/4260-2156-0x00000000005D0000-0x0000000000600000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406405.exe	family_redline
behavioral1/memory/5892-2167-0x0000000000C80000-0x0000000000CAE000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu0053.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation qu0053.exe
Executes dropped EXE 5 IoCs

Processes:

un148683.exepro6317.exequ0053.exe1.exesi406405.exe

pid process

5008 un148683.exe
4032 pro6317.exe
2900 qu0053.exe
4260 1.exe
5892 si406405.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	qu0053.exe

pid	process
5008	un148683.exe
4032	pro6317.exe
2900	qu0053.exe
4260	1.exe
5892	si406405.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro6317.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6317.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6317.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exeun148683.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un148683.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1392 4032 WerFault.exe pro6317.exe
4968 2900 WerFault.exe qu0053.exe

pid	pid_target	process	target process
1392	4032	WerFault.exe	pro6317.exe
4968	2900	WerFault.exe	qu0053.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

qu0053.exe1.exesi406405.exe39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exeun148683.exepro6317.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu0053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si406405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un148683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6317.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro6317.exe

pid process

4032 pro6317.exe
4032 pro6317.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro6317.exequ0053.exe

description pid process

Token: SeDebugPrivilege 4032 pro6317.exe
Token: SeDebugPrivilege 2900 qu0053.exe

pid	process
4032	pro6317.exe
4032	pro6317.exe

description	pid	process
Token: SeDebugPrivilege	4032	pro6317.exe
Token: SeDebugPrivilege	2900	qu0053.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exeun148683.exequ0053.exe

description	pid	process	target process
PID 2140 wrote to memory of 5008	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	un148683.exe
PID 2140 wrote to memory of 5008	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	un148683.exe
PID 2140 wrote to memory of 5008	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	un148683.exe
PID 5008 wrote to memory of 4032	5008	un148683.exe	pro6317.exe
PID 5008 wrote to memory of 4032	5008	un148683.exe	pro6317.exe
PID 5008 wrote to memory of 4032	5008	un148683.exe	pro6317.exe
PID 5008 wrote to memory of 2900	5008	un148683.exe	qu0053.exe
PID 5008 wrote to memory of 2900	5008	un148683.exe	qu0053.exe
PID 5008 wrote to memory of 2900	5008	un148683.exe	qu0053.exe
PID 2900 wrote to memory of 4260	2900	qu0053.exe	1.exe
PID 2900 wrote to memory of 4260	2900	qu0053.exe	1.exe
PID 2900 wrote to memory of 4260	2900	qu0053.exe	1.exe
PID 2140 wrote to memory of 5892	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	si406405.exe
PID 2140 wrote to memory of 5892	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	si406405.exe
PID 2140 wrote to memory of 5892	2140	39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe	si406405.exe

C:\Users\Admin\AppData\Local\Temp\39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe
"C:\Users\Admin\AppData\Local\Temp\39a542622e37a62708ed8c12ecd97a0931b75d73ee1f89a60008d4d81c8fb971.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un148683.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un148683.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6317.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6317.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 1080
4⤵
- Program crash
PID:1392

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0053.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0053.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 1372
4⤵
- Program crash
PID:4968

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406405.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406405.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4032 -ip 4032
1⤵
PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2900 -ip 2900
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si406405.exe

Filesize
168KB

MD5
6b72ebb532af54ac9ad43539b493d670

SHA1
000b1441729ea6f1dd3904f5fb508654b7edcfab

SHA256
34846b9467a8c5327a11fff09a47e99fcc8d43505c563ce07fa832ef28ff69b5

SHA512
7c405c38e7ea8054c5bd26ce7cd39747cce16a2bdc457a6ba999aa0ebaf7996f4af6ff0482464119c2e05a866e3ece19bf1966d918c6afdb1feec13c2e125b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un148683.exe

Filesize
633KB

MD5
4db2f7c5396ac4894d4782d17792dd30

SHA1
279c3c57e72706ac31e0a68524a29602cd411bf0

SHA256
af8900146a94a43adda8bdad6e20caa8659e730f13a0433aad44d240dcc99fad

SHA512
37cfce2a200ba5490af3c172e5ec90570f9935300a690b80c41ec065707dbd1f1103288ea934bff86944c5da10542132eaf40acb9b2c02e45068948a34494bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6317.exe

Filesize
231KB

MD5
51e1b73850ee690b57ddffeb8c82d4ea

SHA1
a8e6b2ce83ba063a066bb44aea0aef1b3c2ba899

SHA256
06f493dd6634adff5ec6fae9ba3bb76fdfe83544cf6b8fcd17f7a99b4608cd60

SHA512
f8242e20d74bc1a7677e8b4d0f58c9a0502d7e01bce7018617220a53e3ffd6a21732327ad0bf5a94977acfb8f5a8fb01cc14a558ba988dc4bb8d57450b645fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0053.exe

Filesize
414KB

MD5
5a4e0965d7913ea378bdf1fb98570acd

SHA1
78355c6485e8fa324ce8794cfdb1c45adcc32f8f

SHA256
e1766d2a0b892ef5a4eeea96a0ce0533eaf71a9a1106d47db4f83705c8dc6141

SHA512
7dc6f97a4832379418736eeaa0110d4c5e2f4e71675d9eac1781e51c9841c370616d64b13487ea6dc874b318db7e0cba1d7cf6a6a6afee074dc8f3713d7a053c

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/2900-69-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-61-0x0000000004A40000-0x0000000004AA6000-memory.dmp

Filesize
408KB

Download
memory/2900-2143-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/2900-63-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-92-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-64-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-96-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-66-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-70-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-72-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-76-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-78-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-80-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-84-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-86-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-88-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-90-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-82-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-74-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-94-0x00000000051C0000-0x000000000521F000-memory.dmp

Filesize
380KB

Download
memory/2900-62-0x00000000051C0000-0x0000000005226000-memory.dmp

Filesize
408KB

Download
memory/4032-31-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-44-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4032-18-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4032-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4032-51-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/4032-22-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-23-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-49-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-50-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/4032-25-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-19-0x00000000022F0000-0x000000000230A000-memory.dmp

Filesize
104KB

Download
memory/4032-33-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-35-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-37-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-39-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-41-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-55-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4032-45-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4032-48-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-29-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-27-0x0000000002580000-0x0000000002592000-memory.dmp

Filesize
72KB

Download
memory/4032-21-0x0000000002580000-0x0000000002598000-memory.dmp

Filesize
96KB

Download
memory/4032-20-0x0000000004DD0000-0x0000000005374000-memory.dmp

Filesize
5.6MB

Download
memory/4032-16-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/4032-15-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/4260-2157-0x00000000026E0000-0x00000000026E6000-memory.dmp

Filesize
24KB

Download
memory/4260-2158-0x00000000055C0000-0x0000000005BD8000-memory.dmp

Filesize
6.1MB

Download
memory/4260-2160-0x0000000004E40000-0x0000000004E52000-memory.dmp

Filesize
72KB

Download
memory/4260-2159-0x00000000050B0000-0x00000000051BA000-memory.dmp

Filesize
1.0MB

Download
memory/4260-2161-0x0000000004FE0000-0x000000000501C000-memory.dmp

Filesize
240KB

Download
memory/4260-2162-0x0000000005020000-0x000000000506C000-memory.dmp

Filesize
304KB

Download
memory/4260-2156-0x00000000005D0000-0x0000000000600000-memory.dmp

Filesize
192KB

Download
memory/5892-2167-0x0000000000C80000-0x0000000000CAE000-memory.dmp

Filesize
184KB

Download
memory/5892-2168-0x0000000005360000-0x0000000005366000-memory.dmp

Filesize
24KB

Download