redline | ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684

Analysis

max time kernel
99s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2023, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe
Size

688KB
MD5

a9a7647ad88eaee2c3d3486d45c9b980
SHA1

a9425800c267d54d0ed7ec812994fa98613757e2
SHA256

ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684
SHA512

c4a79e85e4414298fba9ee09289721f04efbd5ee34a6b4ad2a6dd617d189dd2cda10f659faa656d8ad11df70b162ec441fc7495563c34e7710315cbc3bd44eef
SSDEEP

12288:PMrgy90LiZYh02pFAyS65hLuydOK33uSvYNpSlOwumJev4F4pfigJWXCZ1K/9KE:7yeRBfayQKnuqioMFmJeg4pagJA+W3

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7475.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7475.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral1/memory/1988-190-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-191-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-193-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-195-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-197-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-199-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-201-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-203-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-205-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-207-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-209-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-211-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-213-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-215-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-217-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-219-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-221-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-223-0x0000000003A50000-0x0000000003A8F000-memory.dmp	family_redline
behavioral1/memory/1988-439-0x0000000006220000-0x0000000006230000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
5024	un585742.exe
1724	pro7475.exe
1988	qu9276.exe
4424	si471093.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7475.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7475.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un585742.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un585742.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3628	1724	WerFault.exe	86
1600	1988	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1724	pro7475.exe
1724	pro7475.exe
1988	qu9276.exe
1988	qu9276.exe
4424	si471093.exe
4424	si471093.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	pro7475.exe
Token: SeDebugPrivilege	1988	qu9276.exe
Token: SeDebugPrivilege	4424	si471093.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 5024	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	85
PID 3660 wrote to memory of 5024	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	85
PID 3660 wrote to memory of 5024	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	85
PID 5024 wrote to memory of 1724	5024	un585742.exe	86
PID 5024 wrote to memory of 1724	5024	un585742.exe	86
PID 5024 wrote to memory of 1724	5024	un585742.exe	86
PID 5024 wrote to memory of 1988	5024	un585742.exe	92
PID 5024 wrote to memory of 1988	5024	un585742.exe	92
PID 5024 wrote to memory of 1988	5024	un585742.exe	92
PID 3660 wrote to memory of 4424	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	96
PID 3660 wrote to memory of 4424	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	96
PID 3660 wrote to memory of 4424	3660	ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe	96

C:\Users\Admin\AppData\Local\Temp\ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe
"C:\Users\Admin\AppData\Local\Temp\ab280d89926fb13c73ca6fc90650db6de127d90b0f5a40db8a039f2ef2b9c684.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un585742.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un585742.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7475.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7475.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 1080
      4⤵
      Program crash
      PID:3628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9276.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9276.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 1352
      4⤵
      Program crash
      PID:1600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471093.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471093.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1724 -ip 1724
1⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1988 -ip 1988
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471093.exe

Filesize
175KB

MD5
4cd83cedbadc3e07682264a2d7186d0c

SHA1
d9e7c6923b16f2cb3c507ebdbb3b0b03aa56d275

SHA256
0b109c7daca7d3317cee55ea70384cf6a906519886ea35e3195164622712ac64

SHA512
77911da8ea4ea0f8a27a399826ebf11bfc96579f9b590dc0f8df41845eee8bd60079d0ce16ebcd41d6bd2d4e4dcd288c675ffcbb3a76c22c01f4fa1441e16c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471093.exe

Filesize
175KB

MD5
4cd83cedbadc3e07682264a2d7186d0c

SHA1
d9e7c6923b16f2cb3c507ebdbb3b0b03aa56d275

SHA256
0b109c7daca7d3317cee55ea70384cf6a906519886ea35e3195164622712ac64

SHA512
77911da8ea4ea0f8a27a399826ebf11bfc96579f9b590dc0f8df41845eee8bd60079d0ce16ebcd41d6bd2d4e4dcd288c675ffcbb3a76c22c01f4fa1441e16c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un585742.exe

Filesize
547KB

MD5
0315184d38c79bc8c5f30ced72c182ae

SHA1
2bda78b9c49f8d562cf8eebb858e98f711f758d9

SHA256
f103418acebcddd3d142b6da3b47b6742c8084c0ddad9690c0cb2917ab6e97d0

SHA512
150bab3225ecc366a33668162f416efe7ab1b7119f633900781d61957982bc2238cc82f69c37a7539b2235c5796494471692710dae26ce17a0a48d1d54837ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un585742.exe

Filesize
547KB

MD5
0315184d38c79bc8c5f30ced72c182ae

SHA1
2bda78b9c49f8d562cf8eebb858e98f711f758d9

SHA256
f103418acebcddd3d142b6da3b47b6742c8084c0ddad9690c0cb2917ab6e97d0

SHA512
150bab3225ecc366a33668162f416efe7ab1b7119f633900781d61957982bc2238cc82f69c37a7539b2235c5796494471692710dae26ce17a0a48d1d54837ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7475.exe

Filesize
291KB

MD5
5bd141b9c01ccece96e365a1a62d9436

SHA1
38c4c28459366c671851b664685ca4dd863b2a52

SHA256
473bb62d12f39c45a7f9eb693ceeafd138a8b635da3c572c097c57d9b0276e06

SHA512
777b1dfa396ba86e99c8bb8cb2e9948716702ae59abe029cc4d1b7e6632d8b8e135b5e368e307754bf3ea401b48d0b2685d82d5d73c199e2d799087ddd0b52d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7475.exe

Filesize
291KB

MD5
5bd141b9c01ccece96e365a1a62d9436

SHA1
38c4c28459366c671851b664685ca4dd863b2a52

SHA256
473bb62d12f39c45a7f9eb693ceeafd138a8b635da3c572c097c57d9b0276e06

SHA512
777b1dfa396ba86e99c8bb8cb2e9948716702ae59abe029cc4d1b7e6632d8b8e135b5e368e307754bf3ea401b48d0b2685d82d5d73c199e2d799087ddd0b52d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9276.exe

Filesize
345KB

MD5
8388f3927bdf12410506fdd9a128741a

SHA1
55ea821ee1072e9e4bf1ea1898c7af04f045b225

SHA256
da52204c9f41ba2534e1147d0cece738874ed18000d8ac23d046698817381c37

SHA512
a93a83e106690d159fa6204c6fd4518b10f7c1c5eafbca56b1df59d76190f0460b48d4244d17380883463f0d736fb7ff1b8d2060b0c9fc11c9d0d6fc87f892b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9276.exe

Filesize
345KB

MD5
8388f3927bdf12410506fdd9a128741a

SHA1
55ea821ee1072e9e4bf1ea1898c7af04f045b225

SHA256
da52204c9f41ba2534e1147d0cece738874ed18000d8ac23d046698817381c37

SHA512
a93a83e106690d159fa6204c6fd4518b10f7c1c5eafbca56b1df59d76190f0460b48d4244d17380883463f0d736fb7ff1b8d2060b0c9fc11c9d0d6fc87f892b2

Download Submit
memory/1724-148-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/1724-149-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/1724-150-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/1724-151-0x0000000004D70000-0x0000000005314000-memory.dmp

Filesize
5.6MB

Download
memory/1724-153-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-155-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-152-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-157-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-159-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-161-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-163-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-165-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-167-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-169-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-171-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-173-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-175-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-177-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-179-0x0000000002820000-0x0000000002832000-memory.dmp

Filesize
72KB

Download
memory/1724-180-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/1724-181-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1724-182-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/1724-184-0x00000000027C0000-0x00000000027D0000-memory.dmp

Filesize
64KB

Download
memory/1724-185-0x0000000000400000-0x000000000070B000-memory.dmp

Filesize
3.0MB

Download
memory/1988-193-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-439-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-190-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-195-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-197-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-199-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-201-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-203-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-205-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-207-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-209-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-211-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-213-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-215-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-217-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-219-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-221-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-223-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-438-0x0000000001A30000-0x0000000001A7B000-memory.dmp

Filesize
300KB

Download
memory/1988-191-0x0000000003A50000-0x0000000003A8F000-memory.dmp

Filesize
252KB

Download
memory/1988-442-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-443-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-1100-0x00000000067E0000-0x0000000006DF8000-memory.dmp

Filesize
6.1MB

Download
memory/1988-1101-0x0000000006E40000-0x0000000006F4A000-memory.dmp

Filesize
1.0MB

Download
memory/1988-1102-0x0000000006F50000-0x0000000006F62000-memory.dmp

Filesize
72KB

Download
memory/1988-1103-0x0000000006F70000-0x0000000006FAC000-memory.dmp

Filesize
240KB

Download
memory/1988-1104-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-1106-0x0000000007260000-0x00000000072F2000-memory.dmp

Filesize
584KB

Download
memory/1988-1107-0x0000000007300000-0x0000000007366000-memory.dmp

Filesize
408KB

Download
memory/1988-1108-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-1109-0x0000000006220000-0x0000000006230000-memory.dmp

Filesize
64KB

Download
memory/1988-1110-0x0000000007B30000-0x0000000007CF2000-memory.dmp

Filesize
1.8MB

Download
memory/1988-1111-0x0000000007D00000-0x000000000822C000-memory.dmp

Filesize
5.2MB

Download
memory/1988-1112-0x0000000008320000-0x0000000008396000-memory.dmp

Filesize
472KB

Download
memory/1988-1113-0x00000000083A0000-0x00000000083F0000-memory.dmp

Filesize
320KB

Download
memory/4424-1119-0x0000000000520000-0x0000000000552000-memory.dmp

Filesize
200KB

Download
memory/4424-1120-0x0000000004E10000-0x0000000004E20000-memory.dmp

Filesize
64KB

Download