healer | 6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-11-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe
Size

716KB
MD5

382170d7397b39dd13d2ba5537beb3c2
SHA1

a7a4ec42e10a87f63ccaf0d6fc174db834e34027
SHA256

6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032
SHA512

33b0ab065b32ad509818edaf96bf8e946db5276fb8fa8cea302e4443a530afee4d9e1150f6c80a5c6224719af8a5d153cba8c37cd437e13cf1d61c2369fecb59
SSDEEP

12288:zMr8y903STJuV+/ylezOH/6mPZbCUardOHmvqHSl54g8O5AFxJOlWH5UFiNkWyPj:nyzYV+qlUOHDBG8H4qbg88CHSbuDcuY

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000b000000023b7c-12.dat	healer
behavioral1/memory/3488-15-0x0000000000270000-0x000000000027A000-memory.dmp	healer
behavioral1/memory/1448-22-0x0000000007160000-0x000000000717A000-memory.dmp	healer
behavioral1/memory/1448-24-0x00000000071E0000-0x00000000071F8000-memory.dmp	healer
behavioral1/memory/1448-25-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-44-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-52-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-50-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-48-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-46-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-42-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-40-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-38-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-36-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-34-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-32-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-30-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-28-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer
behavioral1/memory/1448-26-0x00000000071E0000-0x00000000071F2000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c88jH44.exeb0253At.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c88jH44.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b0253At.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b0253At.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b0253At.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b0253At.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b0253At.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c88jH44.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b0253At.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c88jH44.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c88jH44.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c88jH44.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c88jH44.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4960-60-0x0000000004BF0000-0x0000000004C36000-memory.dmp	family_redline
behavioral1/memory/4960-61-0x0000000007100000-0x0000000007144000-memory.dmp	family_redline
behavioral1/memory/4960-65-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-73-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-71-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-69-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-67-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-75-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-63-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-62-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-95-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-93-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-91-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-89-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-87-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-85-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-83-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-81-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-79-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline
behavioral1/memory/4960-77-0x0000000007100000-0x000000000713E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

Processes:

tice4861.exeb0253At.exec88jH44.exedaHrR53.exe

pid	Process
3672	tice4861.exe
3488	b0253At.exe
1448	c88jH44.exe
4960	daHrR53.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b0253At.exec88jH44.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b0253At.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c88jH44.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c88jH44.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exetice4861.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice4861.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
676	1448	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exetice4861.exec88jH44.exedaHrR53.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice4861.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c88jH44.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daHrR53.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b0253At.exec88jH44.exe

pid	Process
3488	b0253At.exe
3488	b0253At.exe
1448	c88jH44.exe
1448	c88jH44.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b0253At.exec88jH44.exedaHrR53.exe

description	pid	Process
Token: SeDebugPrivilege	3488	b0253At.exe
Token: SeDebugPrivilege	1448	c88jH44.exe
Token: SeDebugPrivilege	4960	daHrR53.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exetice4861.exe

description	pid	Process	procid_target
PID 1096 wrote to memory of 3672	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	83
PID 1096 wrote to memory of 3672	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	83
PID 1096 wrote to memory of 3672	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	83
PID 3672 wrote to memory of 3488	3672	tice4861.exe	84
PID 3672 wrote to memory of 3488	3672	tice4861.exe	84
PID 3672 wrote to memory of 1448	3672	tice4861.exe	94
PID 3672 wrote to memory of 1448	3672	tice4861.exe	94
PID 3672 wrote to memory of 1448	3672	tice4861.exe	94
PID 1096 wrote to memory of 4960	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	101
PID 1096 wrote to memory of 4960	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	101
PID 1096 wrote to memory of 4960	1096	6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe	101

C:\Users\Admin\AppData\Local\Temp\6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe
"C:\Users\Admin\AppData\Local\Temp\6e994de5d37e1b82dd06906371db7b41ff23392f791dd8943ffb758205e9e032.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4861.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4861.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0253At.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0253At.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c88jH44.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c88jH44.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1084
      4⤵
      Program crash
      PID:676
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\daHrR53.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\daHrR53.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1448 -ip 1448
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\daHrR53.exe

Filesize
399KB

MD5
a98e1f3e53f5c0d7a985d6d867df5136

SHA1
672bf20051bf3bbd81845cb57102aca3c5b2af5a

SHA256
1d459161ab97dda379008182eaac37adbaf7fb2a24f1366082bdf62aeb827257

SHA512
b41446b41bd065824f701c061c76aee53b55ce99d313e389eb172bc115f3a9d242b8302496d06583d0707741468edb2050fda8066ce19d99c21d1f7150929dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice4861.exe

Filesize
358KB

MD5
0ca856e712190789671dfa5ef4728f2f

SHA1
01905d1f2c0d3596c3c9ac49c11615607f82de22

SHA256
5c05cfa479fc119dc31885e0dcd896bdc7eb636f91e6cfbbc7d44f4b8f34c3c2

SHA512
fe1295fdc49a2d10553227ab356d4b55366d53f888413254fa859698209e26b71f15e6261bf4e92a7609a3c941de7d7b24f76e304bcc9c1d0454cf0d16ba05b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0253At.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c88jH44.exe

Filesize
342KB

MD5
3882ca1c9db76af88259d5e163706f6f

SHA1
dadbb8415da9af8306c34a6e51af5417f8c4439e

SHA256
029310fb6bf44b8cfbf72d94b0d9dc8b73f59d2954efab83d15b75a5d49cba9e

SHA512
5d56810f170980356457ce4c11020a953fb4d54dd8e248e9f70afb84c770423d3e1338a20f09c2da588fb3671c58e5197fb6d1e6b3719ad558748177603a859d

Download Submit
memory/1448-55-0x0000000000400000-0x0000000002B05000-memory.dmp

Filesize
39.0MB

Download
memory/1448-42-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-22-0x0000000007160000-0x000000000717A000-memory.dmp

Filesize
104KB

Download
memory/1448-23-0x00000000072C0000-0x0000000007864000-memory.dmp

Filesize
5.6MB

Download
memory/1448-24-0x00000000071E0000-0x00000000071F8000-memory.dmp

Filesize
96KB

Download
memory/1448-25-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-44-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-52-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-50-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-48-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-46-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-36-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-40-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-38-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-53-0x0000000000400000-0x0000000002B05000-memory.dmp

Filesize
39.0MB

Download
memory/1448-34-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-32-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-30-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-28-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/1448-26-0x00000000071E0000-0x00000000071F2000-memory.dmp

Filesize
72KB

Download
memory/3488-14-0x00007FFCFC7D3000-0x00007FFCFC7D5000-memory.dmp

Filesize
8KB

Download
memory/3488-15-0x0000000000270000-0x000000000027A000-memory.dmp

Filesize
40KB

Download
memory/3488-16-0x00007FFCFC7D3000-0x00007FFCFC7D5000-memory.dmp

Filesize
8KB

Download
memory/4960-77-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-89-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-65-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-73-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-71-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-69-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-67-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-75-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-63-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-61-0x0000000007100000-0x0000000007144000-memory.dmp

Filesize
272KB

Download
memory/4960-95-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-93-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-91-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-62-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-87-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-85-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-83-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-81-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-79-0x0000000007100000-0x000000000713E000-memory.dmp

Filesize
248KB

Download
memory/4960-60-0x0000000004BF0000-0x0000000004C36000-memory.dmp

Filesize
280KB

Download
memory/4960-969-0x0000000007DF0000-0x0000000007EFA000-memory.dmp

Filesize
1.0MB

Download
memory/4960-968-0x0000000007790000-0x0000000007DA8000-memory.dmp

Filesize
6.1MB

Download
memory/4960-970-0x0000000007F30000-0x0000000007F42000-memory.dmp

Filesize
72KB

Download
memory/4960-971-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/4960-972-0x00000000080D0000-0x000000000811C000-memory.dmp

Filesize
304KB

Download