healer | 0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-11-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe
Size

801KB
MD5

75b86167d51119ab6ddf7c7041616423
SHA1

12b0df3c5e4142663fc3a85974dc77721786ea21
SHA256

0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959
SHA512

32e9285b178d67ac878cd306ff3a829ea9bf2d3380c27a1b625f4b4afddce0e95a34476c7bcd37c3467d3b7a485f606ef88b5811ff0f7de1512623a0c4dc03a4
SSDEEP

24576:fyySypRB0KbBnKMNZsjBt0f2gkUJYwriNP:qDypzzbjajBYtFiN

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2292-19-0x0000000002340000-0x000000000235A000-memory.dmp	healer
behavioral1/memory/2292-21-0x0000000002400000-0x0000000002418000-memory.dmp	healer
behavioral1/memory/2292-49-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-47-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-45-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-43-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-41-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-39-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-37-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-35-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-33-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-31-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-29-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-27-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-25-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-23-0x0000000002400000-0x0000000002412000-memory.dmp	healer
behavioral1/memory/2292-22-0x0000000002400000-0x0000000002412000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro6931.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6931.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro6931.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4728-2143-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/4580-2156-0x0000000000C30000-0x0000000000C60000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si024183.exe	family_redline
behavioral1/memory/1268-2165-0x0000000000E50000-0x0000000000E7E000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu9738.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation qu9738.exe
Executes dropped EXE 5 IoCs

Processes:

un779002.exepro6931.exequ9738.exe1.exesi024183.exe

pid process

1972 un779002.exe
2292 pro6931.exe
4728 qu9738.exe
4580 1.exe
1268 si024183.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	qu9738.exe

pid	process
1972	un779002.exe
2292	pro6931.exe
4728	qu9738.exe
4580	1.exe
1268	si024183.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro6931.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6931.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6931.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exeun779002.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un779002.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2964 2292 WerFault.exe pro6931.exe
4376 4728 WerFault.exe qu9738.exe

pid	pid_target	process	target process
2964	2292	WerFault.exe	pro6931.exe
4376	4728	WerFault.exe	qu9738.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

si024183.exe0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exeun779002.exepro6931.exequ9738.exe1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si024183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un779002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro6931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro6931.exe

pid process

2292 pro6931.exe
2292 pro6931.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro6931.exequ9738.exe

description pid process

Token: SeDebugPrivilege 2292 pro6931.exe
Token: SeDebugPrivilege 4728 qu9738.exe

pid	process
2292	pro6931.exe
2292	pro6931.exe

description	pid	process
Token: SeDebugPrivilege	2292	pro6931.exe
Token: SeDebugPrivilege	4728	qu9738.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exeun779002.exequ9738.exe

description	pid	process	target process
PID 3344 wrote to memory of 1972	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	un779002.exe
PID 3344 wrote to memory of 1972	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	un779002.exe
PID 3344 wrote to memory of 1972	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	un779002.exe
PID 1972 wrote to memory of 2292	1972	un779002.exe	pro6931.exe
PID 1972 wrote to memory of 2292	1972	un779002.exe	pro6931.exe
PID 1972 wrote to memory of 2292	1972	un779002.exe	pro6931.exe
PID 1972 wrote to memory of 4728	1972	un779002.exe	qu9738.exe
PID 1972 wrote to memory of 4728	1972	un779002.exe	qu9738.exe
PID 1972 wrote to memory of 4728	1972	un779002.exe	qu9738.exe
PID 4728 wrote to memory of 4580	4728	qu9738.exe	1.exe
PID 4728 wrote to memory of 4580	4728	qu9738.exe	1.exe
PID 4728 wrote to memory of 4580	4728	qu9738.exe	1.exe
PID 3344 wrote to memory of 1268	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	si024183.exe
PID 3344 wrote to memory of 1268	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	si024183.exe
PID 3344 wrote to memory of 1268	3344	0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe	si024183.exe

C:\Users\Admin\AppData\Local\Temp\0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe
"C:\Users\Admin\AppData\Local\Temp\0699efed1e113d261c3b09e3f45cb2c4a116c53bad48d5c7499fa347bf36a959.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un779002.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un779002.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6931.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6931.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 1080
4⤵
- Program crash
PID:2964

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9738.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9738.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 1212
4⤵
- Program crash
PID:4376

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si024183.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si024183.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2292 -ip 2292
1⤵
PID:1340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4728 -ip 4728
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si024183.exe

Filesize
168KB

MD5
5bd6eea11daf61a2a2261cf5c6d3770d

SHA1
e234a717fe2513906c7c43434dbd48ccd0b3c62f

SHA256
987eaba624af09a76f7b773d30da57ef756722d2a126a5470c461a35b2372a44

SHA512
9335187229982f88cb8c5bd625943acb7c681117698057879dafb10a86ba75c438630805496e12058609bc125e1d952e2bbbda693e972a3734bbb8a8fec6a74a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un779002.exe

Filesize
647KB

MD5
21f2445627614b2924a30465dd08749f

SHA1
72dfa29eff02c613375b85ecf197f9eaf5f0fe53

SHA256
0fde1b427777b8d3b95ae1c9380fcd8e68eda7bbf2cccc052da5295f64a9f710

SHA512
c99f36f72365685f9a48deb9a2d87a798453dc1f173392653ea29f3fd75d55fd3f498250e6d88e9f39b19a104806086162459af3b75647d044f9435f0303e39f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6931.exe

Filesize
252KB

MD5
bfbbe6eef2136c29db6bc2a2a272b5b0

SHA1
b005ad54bc42a88c3dec100639a884789ba606eb

SHA256
ee28d6cbeffce978ff08067d6282ae12cb0767fdb1f98cb5b4eb8b57d6ec6eaa

SHA512
85a45eb44658a9b562521bdc303ebe6a3dc16bb46388affd10117b6bd64a153b0cf2586f9170c285565b3c24e22f85b15931d0fffe83e68694f709b74197559a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9738.exe

Filesize
435KB

MD5
28c0f072bd3180b00bb6d9c9a45a2335

SHA1
99dcd6e8934375047875cecc6b25974ca3deb8b6

SHA256
b6b39a617ee3129ecdcb5ebdb5f1055f376b81d15a338c0d2245ff0caf867ae7

SHA512
ea1f537121093f5a1a0f1da0a87122d2e666653e8cba9347fac5df46eb0ef2c788e2662ee6f02d9c31e305a254fe7d4863b85f0241957ba3d6b0c295f86c4077

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1268-2167-0x0000000003020000-0x0000000003026000-memory.dmp

Filesize
24KB

Download
memory/1268-2165-0x0000000000E50000-0x0000000000E7E000-memory.dmp

Filesize
184KB

Download
memory/2292-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2292-23-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-20-0x0000000004AB0000-0x0000000005054000-memory.dmp

Filesize
5.6MB

Download
memory/2292-21-0x0000000002400000-0x0000000002418000-memory.dmp

Filesize
96KB

Download
memory/2292-49-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-47-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-45-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-43-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-41-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-39-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-37-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-35-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-33-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-31-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-29-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-27-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-25-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2292-22-0x0000000002400000-0x0000000002412000-memory.dmp

Filesize
72KB

Download
memory/2292-50-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/2292-51-0x0000000000620000-0x000000000064D000-memory.dmp

Filesize
180KB

Download
memory/2292-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2292-55-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2292-18-0x0000000000400000-0x00000000004AD000-memory.dmp

Filesize
692KB

Download
memory/2292-16-0x0000000000620000-0x000000000064D000-memory.dmp

Filesize
180KB

Download
memory/2292-15-0x0000000000800000-0x0000000000900000-memory.dmp

Filesize
1024KB

Download
memory/2292-19-0x0000000002340000-0x000000000235A000-memory.dmp

Filesize
104KB

Download
memory/4580-2158-0x0000000005B80000-0x0000000006198000-memory.dmp

Filesize
6.1MB

Download
memory/4580-2168-0x0000000005790000-0x00000000057DC000-memory.dmp

Filesize
304KB

Download
memory/4580-2166-0x0000000005610000-0x000000000564C000-memory.dmp

Filesize
240KB

Download
memory/4580-2157-0x00000000013E0000-0x00000000013E6000-memory.dmp

Filesize
24KB

Download
memory/4580-2156-0x0000000000C30000-0x0000000000C60000-memory.dmp

Filesize
192KB

Download
memory/4580-2159-0x0000000005680000-0x000000000578A000-memory.dmp

Filesize
1.0MB

Download
memory/4580-2160-0x00000000055B0000-0x00000000055C2000-memory.dmp

Filesize
72KB

Download
memory/4728-61-0x0000000004B10000-0x0000000004B76000-memory.dmp

Filesize
408KB

Download
memory/4728-84-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-82-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-76-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-75-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-70-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-69-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-66-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-88-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-78-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-90-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-92-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-94-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-96-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-86-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-80-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-62-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/4728-72-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-64-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-63-0x00000000051B0000-0x000000000520F000-memory.dmp

Filesize
380KB

Download
memory/4728-2143-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download