healer | 403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2024 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe
Size

786KB
MD5

5e1de886c62659c6958685d2f4be3d44
SHA1

e2deb59ce23fd95860cd3edbb535d811606c118c
SHA256

403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a
SHA512

c6cb201632be94cceaec60237097d562b5a75a3b268d7f61b2a56e4051885dd15833a298e4dcace85fa19f74a7669d255f0dbb0d8693430182d0827de238c511
SSDEEP

12288:eMrqy9053sL5SaL9l6fv5JqsigjbNQoiMp3mh13GykuDbWo1lV8:oyS8L5bIv5JHDjCo9p3mHmuHW7

Score

10^/10

healer redline diza norm discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

norm

77.91.124.145:4125

Attributes

auth_value
1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

77.91.124.145:4125

Attributes

auth_value
bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1808-19-0x00000000049C0000-0x00000000049DA000-memory.dmp	healer
behavioral1/memory/1808-21-0x0000000004A40000-0x0000000004A58000-memory.dmp	healer
behavioral1/memory/1808-22-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-49-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-47-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-45-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-44-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-42-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-40-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-37-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-35-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-33-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-32-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-29-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-27-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-25-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer
behavioral1/memory/1808-23-0x0000000004A40000-0x0000000004A52000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

pro2954.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro2954.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1756-2143-0x0000000005400000-0x0000000005432000-memory.dmp	family_redline
C:\Windows\Temp\1.exe	family_redline
behavioral1/memory/5456-2156-0x00000000006E0000-0x0000000000710000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si441366.exe	family_redline
behavioral1/memory/5580-2166-0x00000000002B0000-0x00000000002DE000-memory.dmp	family_redline

Redline family
redline
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qu9280.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation qu9280.exe
Executes dropped EXE 5 IoCs

Processes:

un769521.exepro2954.exequ9280.exe1.exesi441366.exe

pid process

1004 un769521.exe
1808 pro2954.exe
1756 qu9280.exe
5456 1.exe
5580 si441366.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	qu9280.exe

pid	process
1004	un769521.exe
1808	pro2954.exe
1756	qu9280.exe
5456	1.exe
5580	si441366.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

pro2954.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro2954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro2954.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

un769521.exe403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un769521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3668 1808 WerFault.exe pro2954.exe
5532 1756 WerFault.exe qu9280.exe

pid	pid_target	process	target process
3668	1808	WerFault.exe	pro2954.exe
5532	1756	WerFault.exe	qu9280.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

un769521.exepro2954.exequ9280.exe1.exesi441366.exe403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	un769521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pro2954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qu9280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	si441366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

pro2954.exe

pid process

1808 pro2954.exe
1808 pro2954.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

pro2954.exequ9280.exe

description pid process

Token: SeDebugPrivilege 1808 pro2954.exe
Token: SeDebugPrivilege 1756 qu9280.exe

pid	process
1808	pro2954.exe
1808	pro2954.exe

description	pid	process
Token: SeDebugPrivilege	1808	pro2954.exe
Token: SeDebugPrivilege	1756	qu9280.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exeun769521.exequ9280.exe

description	pid	process	target process
PID 4052 wrote to memory of 1004	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	un769521.exe
PID 4052 wrote to memory of 1004	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	un769521.exe
PID 4052 wrote to memory of 1004	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	un769521.exe
PID 1004 wrote to memory of 1808	1004	un769521.exe	pro2954.exe
PID 1004 wrote to memory of 1808	1004	un769521.exe	pro2954.exe
PID 1004 wrote to memory of 1808	1004	un769521.exe	pro2954.exe
PID 1004 wrote to memory of 1756	1004	un769521.exe	qu9280.exe
PID 1004 wrote to memory of 1756	1004	un769521.exe	qu9280.exe
PID 1004 wrote to memory of 1756	1004	un769521.exe	qu9280.exe
PID 1756 wrote to memory of 5456	1756	qu9280.exe	1.exe
PID 1756 wrote to memory of 5456	1756	qu9280.exe	1.exe
PID 1756 wrote to memory of 5456	1756	qu9280.exe	1.exe
PID 4052 wrote to memory of 5580	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	si441366.exe
PID 4052 wrote to memory of 5580	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	si441366.exe
PID 4052 wrote to memory of 5580	4052	403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe	si441366.exe

C:\Users\Admin\AppData\Local\Temp\403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe
"C:\Users\Admin\AppData\Local\Temp\403d30295bb0e181ef9867c0f50c160d23c3f01459414e5de3d21053c285d85a.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4052

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un769521.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un769521.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2954.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2954.exe
3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 1096
4⤵
- Program crash
PID:3668

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9280.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9280.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\Temp\1.exe
"C:\Windows\Temp\1.exe"
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 1376
4⤵
- Program crash
PID:5532

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si441366.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si441366.exe
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1808 -ip 1808
1⤵
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1756 -ip 1756
1⤵
PID:5488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si441366.exe

Filesize
169KB

MD5
590edd59536637ee2a76bbe4ed449a1e

SHA1
01cfc054587504103b28b41ae013d1bb4e30b65c

SHA256
0658c352421645530cfc669d8ca0e3eafa2e571b9d0be59e1dc69544d67630b2

SHA512
fe3a7202b767717ebade1f3a889e3ad9e9752251ab86280933539d9e2434594086fdc8cb7321c76a4397903eb2f5a18e80ca1eca15b46b65c4e7b6d0b2325ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un769521.exe

Filesize
633KB

MD5
9248e50de234fcd63b8797b50adc7f36

SHA1
c3091d99162247102453e6571f216dad55810609

SHA256
843b77e00035686842df02f26357e55c19fb174b77b01710886100580e17ac1a

SHA512
e818ed6679b07b5e6185c4ad97449a7a394be753ae2ce64cbed6b585dff789ba44f6ba0b4fe3941d95cf7c7f7028b80ccd38b2d6711d6d3a7a87ce943b9eae3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2954.exe

Filesize
230KB

MD5
0ea5f6a386b8733040180eb417409e37

SHA1
15345895d22053a4ad343176d7a654123e66abcb

SHA256
7c75668247598e0bce91009eae7b6c60edee4c59a052e840e2175ddbcf3d272e

SHA512
91f473c49b4cdce51c0265db0a37245adcd1c926241cdd3259a04322a9b531346e685f1e6654c01a3d2326c2a6b49d1594645fc581bb01214ef4b09905cf279b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9280.exe

Filesize
414KB

MD5
5df13c0e346bf8e3370bda540be7ada4

SHA1
e552d8dfd82a2b82044c8062910c89931c9a71dc

SHA256
e53ede6dd2e5bc94c013c8f80155c0becd1b7f74cd205362c4ded7c3defaa373

SHA512
c18d665d176e337070852da031239a258ab3682fc50eaf5091bda1ded2cdfccec69e2382a7a362b05d08046f7b8e0af599f4e649c26bf59a71accbbb5eee8af3

Download Submit
C:\Windows\Temp\1.exe

Filesize
168KB

MD5
1073b2e7f778788852d3f7bb79929882

SHA1
7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

SHA256
c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

SHA512
90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

Download Submit
memory/1756-68-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-61-0x0000000004C00000-0x0000000004C66000-memory.dmp

Filesize
408KB

Download
memory/1756-2143-0x0000000005400000-0x0000000005432000-memory.dmp

Filesize
200KB

Download
memory/1756-63-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-94-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-64-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-96-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-66-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-70-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-72-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-74-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-76-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-78-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-84-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-86-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-88-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-90-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-82-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-80-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-92-0x0000000004B90000-0x0000000004BEF000-memory.dmp

Filesize
380KB

Download
memory/1756-62-0x0000000004B90000-0x0000000004BF6000-memory.dmp

Filesize
408KB

Download
memory/1808-29-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-42-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-56-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1808-18-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1808-52-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1808-51-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/1808-23-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-25-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-47-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-50-0x00000000006F0000-0x00000000007F0000-memory.dmp

Filesize
1024KB

Download
memory/1808-27-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-19-0x00000000049C0000-0x00000000049DA000-memory.dmp

Filesize
104KB

Download
memory/1808-32-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-33-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-35-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-37-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-40-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-55-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1808-44-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-16-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/1808-45-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-49-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-22-0x0000000004A40000-0x0000000004A52000-memory.dmp

Filesize
72KB

Download
memory/1808-21-0x0000000004A40000-0x0000000004A58000-memory.dmp

Filesize
96KB

Download
memory/1808-20-0x0000000004A90000-0x0000000005034000-memory.dmp

Filesize
5.6MB

Download
memory/1808-17-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1808-15-0x00000000006F0000-0x00000000007F0000-memory.dmp

Filesize
1024KB

Download
memory/5456-2157-0x0000000004EC0000-0x0000000004EC6000-memory.dmp

Filesize
24KB

Download
memory/5456-2158-0x0000000005670000-0x0000000005C88000-memory.dmp

Filesize
6.1MB

Download
memory/5456-2159-0x0000000005160000-0x000000000526A000-memory.dmp

Filesize
1.0MB

Download
memory/5456-2160-0x0000000005070000-0x0000000005082000-memory.dmp

Filesize
72KB

Download
memory/5456-2156-0x00000000006E0000-0x0000000000710000-memory.dmp

Filesize
192KB

Download
memory/5456-2165-0x00000000050D0000-0x000000000510C000-memory.dmp

Filesize
240KB

Download
memory/5456-2168-0x0000000005110000-0x000000000515C000-memory.dmp

Filesize
304KB

Download
memory/5580-2166-0x00000000002B0000-0x00000000002DE000-memory.dmp

Filesize
184KB

Download
memory/5580-2167-0x0000000002540000-0x0000000002546000-memory.dmp

Filesize
24KB

Download