redline | 3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da

Analysis

max time kernel
67s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2023, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe
Size

529KB
MD5

3fa0829a943bc10f93ce0e8f4aa01e3d
SHA1

0db1ac3e5aa156f79a8963a5ba38d4d52077ff15
SHA256

3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da
SHA512

c356e2f6f2f0bca273ecc6649f4d0e2e85c6d269e737341b4906394a1583ff2fad04d62f5e1e4424ef3450e9d22aae084f07c3dada89f025ac08da2a23c3adcc
SSDEEP

12288:eMrEy902HRyawK05Qalg0eqESBJgo0Q9c0zmySwPDIvX6P:myTh053lg0t/IeSRiP

Score

10^/10

redline rosn spora discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

176.113.115.145:4125

Attributes

auth_value
441b39ab37774b2ca9931c31e1bc6071

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	jr260645.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	jr260645.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	jr260645.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	jr260645.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	jr260645.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	jr260645.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

resource	yara_rule
behavioral1/memory/264-159-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-161-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-171-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-181-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-183-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-179-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-191-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-203-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-217-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-219-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-221-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-215-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-213-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-211-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-209-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-207-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-205-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-201-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-199-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-197-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-195-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-193-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-189-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-187-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-185-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-177-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-175-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-173-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-169-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-167-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-165-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-163-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline
behavioral1/memory/264-158-0x0000000004B30000-0x0000000004B6F000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1392	zipb8734.exe
1992	jr260645.exe
264	ku753543.exe
1656	lr526344.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	jr260645.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zipb8734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zipb8734.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1280	264	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1992	jr260645.exe
1992	jr260645.exe
264	ku753543.exe
264	ku753543.exe
1656	lr526344.exe
1656	lr526344.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	jr260645.exe
Token: SeDebugPrivilege	264	ku753543.exe
Token: SeDebugPrivilege	1656	lr526344.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1392	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	85
PID 2160 wrote to memory of 1392	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	85
PID 2160 wrote to memory of 1392	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	85
PID 1392 wrote to memory of 1992	1392	zipb8734.exe	86
PID 1392 wrote to memory of 1992	1392	zipb8734.exe	86
PID 1392 wrote to memory of 264	1392	zipb8734.exe	89
PID 1392 wrote to memory of 264	1392	zipb8734.exe	89
PID 1392 wrote to memory of 264	1392	zipb8734.exe	89
PID 2160 wrote to memory of 1656	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	93
PID 2160 wrote to memory of 1656	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	93
PID 2160 wrote to memory of 1656	2160	3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe	93

C:\Users\Admin\AppData\Local\Temp\3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe
"C:\Users\Admin\AppData\Local\Temp\3a06e2e4461153ce6b678f9768d7de7a0de51fc7f9cc95bb7cc0c489a5c586da.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipb8734.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipb8734.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr260645.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr260645.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku753543.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku753543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:264
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 1336
      4⤵
      Program crash
      PID:1280
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr526344.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr526344.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 264 -ip 264
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr526344.exe

Filesize
176KB

MD5
7871de06338154e2ca3ef5dfa9a93eb5

SHA1
00212ec7b50e1d546d92c255a989e94aa5e4d490

SHA256
733d14924eeb676e0e7f44e6fc618a35d8bcf122f9453e341a70757a6f38bcf8

SHA512
8a59a41a24903f80845fc802d8b24566cc36498aa170117e4dcf0030fa592d2d6c4bf8b633fc9f8000879c86991800d037123db5a35ba131341c24dcc84cf690

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr526344.exe

Filesize
176KB

MD5
7871de06338154e2ca3ef5dfa9a93eb5

SHA1
00212ec7b50e1d546d92c255a989e94aa5e4d490

SHA256
733d14924eeb676e0e7f44e6fc618a35d8bcf122f9453e341a70757a6f38bcf8

SHA512
8a59a41a24903f80845fc802d8b24566cc36498aa170117e4dcf0030fa592d2d6c4bf8b633fc9f8000879c86991800d037123db5a35ba131341c24dcc84cf690

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipb8734.exe

Filesize
387KB

MD5
1bad8fb305dd5f79b335f2a5e8a77162

SHA1
4645bdf331222774f66fef1b2a6bdeb3b8c4227c

SHA256
45e348430daebdea869751f789e24309ba0fecfad9eb8e54be1c4aa7781c3d3e

SHA512
f5cc446a5d60c4a55ed2d19993a1e8354b815aa65b6ed83af175b16b08a223f299bb62854968671c2eb00b3ecb8dbfbc35ed6ffa752b2b422935e2610dc2f5be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zipb8734.exe

Filesize
387KB

MD5
1bad8fb305dd5f79b335f2a5e8a77162

SHA1
4645bdf331222774f66fef1b2a6bdeb3b8c4227c

SHA256
45e348430daebdea869751f789e24309ba0fecfad9eb8e54be1c4aa7781c3d3e

SHA512
f5cc446a5d60c4a55ed2d19993a1e8354b815aa65b6ed83af175b16b08a223f299bb62854968671c2eb00b3ecb8dbfbc35ed6ffa752b2b422935e2610dc2f5be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr260645.exe

Filesize
12KB

MD5
043a8b533e230bd63bc256e67bd5eec9

SHA1
312cb24d443c3ee952d0b77a854029ecfade190d

SHA256
43d695677f76daa84dcbe4863620cc726d02fed68dc2fe2363b442abca418e04

SHA512
5cc71ca268532d5ee3b49d7f5e5c21c24e3681951dd8ae7ddff205d43e9dae0b4cd3ac80702937c31f8b8c59afc4da1200030f5d92c9407dc46a095e3255ac9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr260645.exe

Filesize
12KB

MD5
043a8b533e230bd63bc256e67bd5eec9

SHA1
312cb24d443c3ee952d0b77a854029ecfade190d

SHA256
43d695677f76daa84dcbe4863620cc726d02fed68dc2fe2363b442abca418e04

SHA512
5cc71ca268532d5ee3b49d7f5e5c21c24e3681951dd8ae7ddff205d43e9dae0b4cd3ac80702937c31f8b8c59afc4da1200030f5d92c9407dc46a095e3255ac9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku753543.exe

Filesize
342KB

MD5
333699e889064107c037d0141e3d1f69

SHA1
6f23e2b0d4477db57c488fd41bcda8de3173363d

SHA256
3fc6a28bcf459704e0026c7ba056ef703f1ce0d5a348bb010c6771e0f623a4a9

SHA512
08e8044c8a8bf3f2c00e398ee0f8e9ee84ed468d7b3138bb1c039492f39d7a422cedca4d725426c1273cd1ea1057d8c021d945b4acbf672aa287a4a2d5838335

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku753543.exe

Filesize
342KB

MD5
333699e889064107c037d0141e3d1f69

SHA1
6f23e2b0d4477db57c488fd41bcda8de3173363d

SHA256
3fc6a28bcf459704e0026c7ba056ef703f1ce0d5a348bb010c6771e0f623a4a9

SHA512
08e8044c8a8bf3f2c00e398ee0f8e9ee84ed468d7b3138bb1c039492f39d7a422cedca4d725426c1273cd1ea1057d8c021d945b4acbf672aa287a4a2d5838335

Download Submit
memory/264-153-0x0000000002C30000-0x0000000002C7B000-memory.dmp

Filesize
300KB

Download
memory/264-154-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-156-0x0000000007280000-0x0000000007824000-memory.dmp

Filesize
5.6MB

Download
memory/264-157-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-155-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-159-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-161-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-171-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-181-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-183-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-179-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-191-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-203-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-217-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-219-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-221-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-215-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-213-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-211-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-209-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-207-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-205-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-201-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-199-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-197-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-195-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-193-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-189-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-187-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-185-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-177-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-175-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-173-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-169-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-167-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-165-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-163-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-158-0x0000000004B30000-0x0000000004B6F000-memory.dmp

Filesize
252KB

Download
memory/264-1064-0x0000000007830000-0x0000000007E48000-memory.dmp

Filesize
6.1MB

Download
memory/264-1065-0x0000000007E50000-0x0000000007F5A000-memory.dmp

Filesize
1.0MB

Download
memory/264-1066-0x0000000007F70000-0x0000000007F82000-memory.dmp

Filesize
72KB

Download
memory/264-1067-0x0000000007F90000-0x0000000007FCC000-memory.dmp

Filesize
240KB

Download
memory/264-1068-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-1070-0x0000000008280000-0x0000000008312000-memory.dmp

Filesize
584KB

Download
memory/264-1071-0x0000000008320000-0x0000000008386000-memory.dmp

Filesize
408KB

Download
memory/264-1072-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-1073-0x0000000008A20000-0x0000000008A96000-memory.dmp

Filesize
472KB

Download
memory/264-1074-0x0000000008AB0000-0x0000000008B00000-memory.dmp

Filesize
320KB

Download
memory/264-1075-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/264-1076-0x0000000008DA0000-0x0000000008F62000-memory.dmp

Filesize
1.8MB

Download
memory/264-1077-0x0000000008F70000-0x000000000949C000-memory.dmp

Filesize
5.2MB

Download
memory/1656-1083-0x0000000000200000-0x0000000000232000-memory.dmp

Filesize
200KB

Download
memory/1656-1084-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/1992-147-0x0000000000610000-0x000000000061A000-memory.dmp

Filesize
40KB

Download