healer | a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0

Analysis

max time kernel
113s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe
Size

646KB
MD5

368c05dbf86c99ad265c0fc83c6c30c9
SHA1

3c5853b7336bf7a56047d59712a2b86c154ce939
SHA256

a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0
SHA512

062a351a7f28e238337d42c081028b029d46850d00e3869eacd8790490bbcd1365f703ed987324fe49644b9a36faee7c531911479ab87e3703288a741a7d1ca4
SSDEEP

12288:WMray901szsHBCoo0lCg2mhzfZrfIeIHVP9DhkHxJfdv1Nquyr:My+JCooGCg2grRuHVPPk7fd+uyr

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0009000000023c20-12.dat	healer
behavioral1/memory/4044-15-0x0000000000D80000-0x0000000000D8A000-memory.dmp	healer
behavioral1/memory/3332-22-0x0000000002360000-0x000000000237A000-memory.dmp	healer
behavioral1/memory/3332-24-0x0000000002740000-0x0000000002758000-memory.dmp	healer
behavioral1/memory/3332-30-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-52-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-50-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-48-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-46-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-45-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-42-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-41-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-38-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-36-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-34-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-32-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-28-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-26-0x0000000002740000-0x0000000002752000-memory.dmp	healer
behavioral1/memory/3332-25-0x0000000002740000-0x0000000002752000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

c52Nb75.exeb8107eA.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8107eA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c52Nb75.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8107eA.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/532-60-0x0000000002370000-0x00000000023B6000-memory.dmp	family_redline
behavioral1/memory/532-61-0x0000000002560000-0x00000000025A4000-memory.dmp	family_redline
behavioral1/memory/532-83-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-73-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-65-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-63-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-95-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-93-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-91-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-89-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-87-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-85-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-81-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-79-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-77-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-75-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-71-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-69-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-67-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline
behavioral1/memory/532-62-0x0000000002560000-0x000000000259E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

Processes:

tice2945.exeb8107eA.exec52Nb75.exeddYyc93.exe

pid	Process
1124	tice2945.exe
4044	b8107eA.exe
3332	c52Nb75.exe
532	ddYyc93.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

b8107eA.exec52Nb75.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8107eA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c52Nb75.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exetice2945.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice2945.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2408	3332	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exetice2945.exec52Nb75.exeddYyc93.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c52Nb75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddYyc93.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b8107eA.exec52Nb75.exe

pid	Process
4044	b8107eA.exe
4044	b8107eA.exe
3332	c52Nb75.exe
3332	c52Nb75.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b8107eA.exec52Nb75.exeddYyc93.exe

description	pid	Process
Token: SeDebugPrivilege	4044	b8107eA.exe
Token: SeDebugPrivilege	3332	c52Nb75.exe
Token: SeDebugPrivilege	532	ddYyc93.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exetice2945.exe

description	pid	Process	procid_target
PID 3192 wrote to memory of 1124	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	83
PID 3192 wrote to memory of 1124	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	83
PID 3192 wrote to memory of 1124	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	83
PID 1124 wrote to memory of 4044	1124	tice2945.exe	84
PID 1124 wrote to memory of 4044	1124	tice2945.exe	84
PID 1124 wrote to memory of 3332	1124	tice2945.exe	96
PID 1124 wrote to memory of 3332	1124	tice2945.exe	96
PID 1124 wrote to memory of 3332	1124	tice2945.exe	96
PID 3192 wrote to memory of 532	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	101
PID 3192 wrote to memory of 532	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	101
PID 3192 wrote to memory of 532	3192	a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe	101

C:\Users\Admin\AppData\Local\Temp\a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe
"C:\Users\Admin\AppData\Local\Temp\a25e8fa6fad062fc3bf3a5adaf9e27b9407af7f76129907071645b545e14e4f0.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1084
      4⤵
      Program crash
      PID:2408
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3332 -ip 3332
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe

Filesize
283KB

MD5
0e86603d47de52ef4d904e3c89b078fb

SHA1
e1a8b6bc124888c1abdc3b1c883f4283937a4107

SHA256
b06ebfbc5b2e466f9ae889fa4dc06109f06583b395dcd2a8f35a180846034980

SHA512
a386bdfb4c5399f238f71ff73d408da95e901cfd6c091b87a4b42c0b1dfb2428824f600c44a42966f926418ff7630572081308bd41fef881adfca688eecbd3d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe

Filesize
323KB

MD5
5e5acbf9227de967a910d3844779325a

SHA1
16652f26a0fdb567da2c74c2c9e9c3c89951743b

SHA256
16314bb7565d624b73b4a6b561300d5be9ce88909de1b4415d6bd23637325bc7

SHA512
3dd7af2f709020f266ba01c66b396c4d4a4b48deeeb5842349ec84089d188322f8bbe8d3bd90fbcd4ac4f7fcad546d815d89dc6938c32b01e25c3dc952e13383

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe

Filesize
225KB

MD5
ead09b27d9eb447fc3d29af47b9bbe69

SHA1
fbd19ce80761bdaf601b467b5696b6db3a35971b

SHA256
d2357dbafe6b4ac8856aab3c9faaa9bdcaac823488dfe02259325d5ec3ad1c68

SHA512
67988dfa9fafdaa247a2a207df1188cb818d58505d5fe38a96d16c898206a0b5d0dca4ca4fae85493c46bffa49d5ece98a46467507f047f4998a151d103f9794

Download Submit
memory/532-81-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-85-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-972-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download
memory/532-971-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/532-970-0x0000000004D00000-0x0000000004D12000-memory.dmp

Filesize
72KB

Download
memory/532-969-0x0000000004BC0000-0x0000000004CCA000-memory.dmp

Filesize
1.0MB

Download
memory/532-968-0x00000000052E0000-0x00000000058F8000-memory.dmp

Filesize
6.1MB

Download
memory/532-60-0x0000000002370000-0x00000000023B6000-memory.dmp

Filesize
280KB

Download
memory/532-67-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-69-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-71-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-75-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-77-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-79-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-87-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-61-0x0000000002560000-0x00000000025A4000-memory.dmp

Filesize
272KB

Download
memory/532-91-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-93-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-95-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-63-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-65-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-73-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-83-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-62-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/532-89-0x0000000002560000-0x000000000259E000-memory.dmp

Filesize
248KB

Download
memory/3332-24-0x0000000002740000-0x0000000002758000-memory.dmp

Filesize
96KB

Download
memory/3332-48-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-36-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-25-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-26-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-28-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-32-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-34-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-42-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-41-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-53-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3332-23-0x0000000004D10000-0x00000000052B4000-memory.dmp

Filesize
5.6MB

Download
memory/3332-22-0x0000000002360000-0x000000000237A000-memory.dmp

Filesize
104KB

Download
memory/3332-38-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-45-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-46-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-55-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/3332-50-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-52-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/3332-30-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4044-14-0x00007FFAB1163000-0x00007FFAB1165000-memory.dmp

Filesize
8KB

Download
memory/4044-16-0x00007FFAB1163000-0x00007FFAB1165000-memory.dmp

Filesize
8KB

Download
memory/4044-15-0x0000000000D80000-0x0000000000D8A000-memory.dmp

Filesize
40KB

Download