healer | 29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83

Analysis

max time kernel
112s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe
Size

646KB
MD5

76cc9f51fb5c0a3fbc9ecbed147d8eb0
SHA1

d8db3988c478b61309da2cbf6dacda1cb09893a0
SHA256

29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83
SHA512

d3c1eb231dbb93c8a233348dc482ecb5d0799e20cf25c5b286b8b15c979c8cba97a923dbb85f534b7d379556ea64aab2cc62ab73dc616afb89f6f16e4e619044
SSDEEP

12288:WMray901szsHBCoo0lCg2mhzfZrfIeIHVP9DhkHxJfdv1Nquy:My+JCooGCg2grRuHVPPk7fd+uy

Score

10^/10

healer redline mango discovery dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

mango

193.233.20.28:4125

Attributes

auth_value
ecf79d7f5227d998a3501c972d915d23

Signatures

Detects Healer an antivirus disabler dropper 19 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0008000000023c79-12.dat	healer
behavioral1/memory/5112-15-0x0000000000AF0000-0x0000000000AFA000-memory.dmp	healer
behavioral1/memory/2280-22-0x0000000002380000-0x000000000239A000-memory.dmp	healer
behavioral1/memory/2280-24-0x0000000004A50000-0x0000000004A68000-memory.dmp	healer
behavioral1/memory/2280-25-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-32-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-50-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-48-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-46-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-44-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-42-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-40-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-38-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-36-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-34-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-30-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-28-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-26-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer
behavioral1/memory/2280-52-0x0000000004A50000-0x0000000004A62000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

b8107eA.exec52Nb75.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	b8107eA.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	b8107eA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	c52Nb75.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/944-60-0x00000000025C0000-0x0000000002606000-memory.dmp	family_redline
behavioral1/memory/944-61-0x0000000004AD0000-0x0000000004B14000-memory.dmp	family_redline
behavioral1/memory/944-69-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-71-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-95-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-93-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-91-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-89-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-87-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-85-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-83-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-81-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-79-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-77-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-75-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-73-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-67-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-66-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-63-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline
behavioral1/memory/944-62-0x0000000004AD0000-0x0000000004B0E000-memory.dmp	family_redline

Redline family
redline

Executes dropped EXE 4 IoCs

Processes:

tice2945.exeb8107eA.exec52Nb75.exeddYyc93.exe

pid	Process
4856	tice2945.exe
5112	b8107eA.exe
2280	c52Nb75.exe
944	ddYyc93.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

c52Nb75.exeb8107eA.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	c52Nb75.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	b8107eA.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	c52Nb75.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exetice2945.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tice2945.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
924	2280	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c52Nb75.exeddYyc93.exe29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exetice2945.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c52Nb75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ddYyc93.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tice2945.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

b8107eA.exec52Nb75.exe

pid	Process
5112	b8107eA.exe
5112	b8107eA.exe
2280	c52Nb75.exe
2280	c52Nb75.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b8107eA.exec52Nb75.exeddYyc93.exe

description	pid	Process
Token: SeDebugPrivilege	5112	b8107eA.exe
Token: SeDebugPrivilege	2280	c52Nb75.exe
Token: SeDebugPrivilege	944	ddYyc93.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exetice2945.exe

description	pid	Process	procid_target
PID 1860 wrote to memory of 4856	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	83
PID 1860 wrote to memory of 4856	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	83
PID 1860 wrote to memory of 4856	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	83
PID 4856 wrote to memory of 5112	4856	tice2945.exe	85
PID 4856 wrote to memory of 5112	4856	tice2945.exe	85
PID 4856 wrote to memory of 2280	4856	tice2945.exe	95
PID 4856 wrote to memory of 2280	4856	tice2945.exe	95
PID 4856 wrote to memory of 2280	4856	tice2945.exe	95
PID 1860 wrote to memory of 944	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	100
PID 1860 wrote to memory of 944	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	100
PID 1860 wrote to memory of 944	1860	29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe	100

C:\Users\Admin\AppData\Local\Temp\29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe
"C:\Users\Admin\AppData\Local\Temp\29d9f8d91a952af86673672f77edafc81e15840ef0535b94ce21ba7e733ccd83N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1084
      4⤵
      Program crash
      PID:924
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ddYyc93.exe

Filesize
283KB

MD5
0e86603d47de52ef4d904e3c89b078fb

SHA1
e1a8b6bc124888c1abdc3b1c883f4283937a4107

SHA256
b06ebfbc5b2e466f9ae889fa4dc06109f06583b395dcd2a8f35a180846034980

SHA512
a386bdfb4c5399f238f71ff73d408da95e901cfd6c091b87a4b42c0b1dfb2428824f600c44a42966f926418ff7630572081308bd41fef881adfca688eecbd3d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2945.exe

Filesize
323KB

MD5
5e5acbf9227de967a910d3844779325a

SHA1
16652f26a0fdb567da2c74c2c9e9c3c89951743b

SHA256
16314bb7565d624b73b4a6b561300d5be9ce88909de1b4415d6bd23637325bc7

SHA512
3dd7af2f709020f266ba01c66b396c4d4a4b48deeeb5842349ec84089d188322f8bbe8d3bd90fbcd4ac4f7fcad546d815d89dc6938c32b01e25c3dc952e13383

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b8107eA.exe

Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c52Nb75.exe

Filesize
225KB

MD5
ead09b27d9eb447fc3d29af47b9bbe69

SHA1
fbd19ce80761bdaf601b467b5696b6db3a35971b

SHA256
d2357dbafe6b4ac8856aab3c9faaa9bdcaac823488dfe02259325d5ec3ad1c68

SHA512
67988dfa9fafdaa247a2a207df1188cb818d58505d5fe38a96d16c898206a0b5d0dca4ca4fae85493c46bffa49d5ece98a46467507f047f4998a151d103f9794

Download Submit
memory/944-79-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-81-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-972-0x0000000005A50000-0x0000000005A9C000-memory.dmp

Filesize
304KB

Download
memory/944-971-0x0000000005900000-0x000000000593C000-memory.dmp

Filesize
240KB

Download
memory/944-970-0x00000000058E0000-0x00000000058F2000-memory.dmp

Filesize
72KB

Download
memory/944-969-0x00000000057C0000-0x00000000058CA000-memory.dmp

Filesize
1.0MB

Download
memory/944-968-0x00000000051A0000-0x00000000057B8000-memory.dmp

Filesize
6.1MB

Download
memory/944-60-0x00000000025C0000-0x0000000002606000-memory.dmp

Filesize
280KB

Download
memory/944-63-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-66-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-67-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-73-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-75-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-77-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-83-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-61-0x0000000004AD0000-0x0000000004B14000-memory.dmp

Filesize
272KB

Download
memory/944-87-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-89-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-91-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-93-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-95-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-71-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-69-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-62-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/944-85-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

Filesize
248KB

Download
memory/2280-24-0x0000000004A50000-0x0000000004A68000-memory.dmp

Filesize
96KB

Download
memory/2280-48-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-36-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-52-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-26-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-28-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-30-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-34-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-42-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-40-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-53-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2280-23-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/2280-22-0x0000000002380000-0x000000000239A000-memory.dmp

Filesize
104KB

Download
memory/2280-38-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-44-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-46-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-55-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2280-50-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-32-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/2280-25-0x0000000004A50000-0x0000000004A62000-memory.dmp

Filesize
72KB

Download
memory/5112-14-0x00007FFA966D3000-0x00007FFA966D5000-memory.dmp

Filesize
8KB

Download
memory/5112-16-0x00007FFA966D3000-0x00007FFA966D5000-memory.dmp

Filesize
8KB

Download
memory/5112-15-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

Filesize
40KB

Download