quasar | f5a558eba4843612e1b2e7bbfb431932a94bdc86f9411c0529f4216bcfe0ef02

Analysis

max time kernel
147s
max time network
165s
platform
windows10_x64
resource
win10v20210410
submitted
20/06/2021, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BC8478F5CAA7B719234C8E1CF8395B12.exe
Size 10.7MB
Sample210620-13g2cn2bpa
SHA256 f5a558eba4843612e1b2e7bbfb431932a94bdc86f9411c0529f4216bcfe0ef02
MD5 bc8478f5caa7b719234c8e1cf8395b12
SHA1 e0826e5b992b7aa566c557c71d6614804bd1430b
SHA512 5416ef09f8768f0ef6bddb85257c605539f62602dcc251ea47332190fd923fbf3b12e2bc0db8517513d4218dc4f68efdd2c6c1c0b3426c918c76b1d297abc940
MD5 SHA1 SHA512

Score

10^/10

quasar redline office discovery infostealer spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

5.61.62.193:5552

Mutex

yeGmQfVnPgbImyPaxF

Attributes

encryption_key
NW9ZIW6yy48cx5RgKTcR
install_name
csrss.exe
log_directory
Logs
reconnect_delay
3000
startup_key
NET framework
subdirectory
SubDir

Signatures

Quasar Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2008-204-0x0000000000740000-0x000000000078E000-memory.dmp	family_quasar
behavioral2/memory/2008-211-0x0000000004F10000-0x000000000540E000-memory.dmp	family_quasar
behavioral2/memory/3468-216-0x00000000011A0000-0x000000000124E000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/780-217-0x00000000003A0000-0x00000000003BE000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
1916	BC8478F5CAA7B719234C8E1CF8395B12.tmp
2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp
1960	SRBPolaris.exe
2808	driv.exe
2120	CCLI.exe
688	ref.exe
4028	Velavi.exe.com
2200	Velavi.exe.com
3064	Rivederlo.exe.com
3468	Rivederlo.exe.com
2008	RegAsm.exe
780	RegAsm.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uLpXHRtLdZ.url	Velavi.exe.com

Loads dropped DLL 1 IoCs

pid	Process
2808	driv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe
1960	SRBPolaris.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 2008	2200	Velavi.exe.com	102
PID 3468 set thread context of 780	3468	Rivederlo.exe.com	104

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\My Program\SRBPolaris.exe	BC8478F5CAA7B719234C8E1CF8395B12.tmp
File opened for modification	C:\Program Files (x86)\My Program\driv.exe	BC8478F5CAA7B719234C8E1CF8395B12.tmp
File opened for modification	C:\Program Files (x86)\My Program\flash.dll	BC8478F5CAA7B719234C8E1CF8395B12.tmp
File created	C:\Program Files (x86)\My Program\is-LAE0Q.tmp	BC8478F5CAA7B719234C8E1CF8395B12.tmp
File created	C:\Program Files (x86)\My Program\is-S551G.tmp	BC8478F5CAA7B719234C8E1CF8395B12.tmp
File created	C:\Program Files (x86)\My Program\is-PS834.tmp	BC8478F5CAA7B719234C8E1CF8395B12.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1408	PING.EXE
2184	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp
2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp
780	RegAsm.exe
780	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	RegAsm.exe
Token: SeDebugPrivilege	780	RegAsm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1916	3944	BC8478F5CAA7B719234C8E1CF8395B12.exe	75
PID 3944 wrote to memory of 1916	3944	BC8478F5CAA7B719234C8E1CF8395B12.exe	75
PID 3944 wrote to memory of 1916	3944	BC8478F5CAA7B719234C8E1CF8395B12.exe	75
PID 1916 wrote to memory of 4012	1916	BC8478F5CAA7B719234C8E1CF8395B12.tmp	76
PID 1916 wrote to memory of 4012	1916	BC8478F5CAA7B719234C8E1CF8395B12.tmp	76
PID 1916 wrote to memory of 4012	1916	BC8478F5CAA7B719234C8E1CF8395B12.tmp	76
PID 4012 wrote to memory of 2940	4012	BC8478F5CAA7B719234C8E1CF8395B12.exe	78
PID 4012 wrote to memory of 2940	4012	BC8478F5CAA7B719234C8E1CF8395B12.exe	78
PID 4012 wrote to memory of 2940	4012	BC8478F5CAA7B719234C8E1CF8395B12.exe	78
PID 2940 wrote to memory of 1960	2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp	79
PID 2940 wrote to memory of 1960	2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp	79
PID 2940 wrote to memory of 2808	2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp	80
PID 2940 wrote to memory of 2808	2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp	80
PID 2940 wrote to memory of 2808	2940	BC8478F5CAA7B719234C8E1CF8395B12.tmp	80
PID 2808 wrote to memory of 2120	2808	driv.exe	81
PID 2808 wrote to memory of 2120	2808	driv.exe	81
PID 2808 wrote to memory of 2120	2808	driv.exe	81
PID 2120 wrote to memory of 644	2120	CCLI.exe	82
PID 2120 wrote to memory of 644	2120	CCLI.exe	82
PID 2120 wrote to memory of 644	2120	CCLI.exe	82
PID 644 wrote to memory of 212	644	cmd.exe	84
PID 644 wrote to memory of 212	644	cmd.exe	84
PID 644 wrote to memory of 212	644	cmd.exe	84
PID 212 wrote to memory of 2040	212	cmd.exe	85
PID 212 wrote to memory of 2040	212	cmd.exe	85
PID 212 wrote to memory of 2040	212	cmd.exe	85
PID 2808 wrote to memory of 688	2808	driv.exe	86
PID 2808 wrote to memory of 688	2808	driv.exe	86
PID 2808 wrote to memory of 688	2808	driv.exe	86
PID 688 wrote to memory of 3024	688	ref.exe	87
PID 688 wrote to memory of 3024	688	ref.exe	87
PID 688 wrote to memory of 3024	688	ref.exe	87
PID 212 wrote to memory of 4028	212	cmd.exe	89
PID 212 wrote to memory of 4028	212	cmd.exe	89
PID 212 wrote to memory of 4028	212	cmd.exe	89
PID 3024 wrote to memory of 2108	3024	cmd.exe	90
PID 3024 wrote to memory of 2108	3024	cmd.exe	90
PID 3024 wrote to memory of 2108	3024	cmd.exe	90
PID 2108 wrote to memory of 2308	2108	cmd.exe	91
PID 2108 wrote to memory of 2308	2108	cmd.exe	91
PID 2108 wrote to memory of 2308	2108	cmd.exe	91
PID 212 wrote to memory of 1408	212	cmd.exe	92
PID 212 wrote to memory of 1408	212	cmd.exe	92
PID 212 wrote to memory of 1408	212	cmd.exe	92
PID 4028 wrote to memory of 2200	4028	Velavi.exe.com	93
PID 4028 wrote to memory of 2200	4028	Velavi.exe.com	93
PID 4028 wrote to memory of 2200	4028	Velavi.exe.com	93
PID 2108 wrote to memory of 3064	2108	cmd.exe	94
PID 2108 wrote to memory of 3064	2108	cmd.exe	94
PID 2108 wrote to memory of 3064	2108	cmd.exe	94
PID 2108 wrote to memory of 2184	2108	cmd.exe	95
PID 2108 wrote to memory of 2184	2108	cmd.exe	95
PID 2108 wrote to memory of 2184	2108	cmd.exe	95
PID 3064 wrote to memory of 3468	3064	Rivederlo.exe.com	96
PID 3064 wrote to memory of 3468	3064	Rivederlo.exe.com	96
PID 3064 wrote to memory of 3468	3064	Rivederlo.exe.com	96
PID 2200 wrote to memory of 2008	2200	Velavi.exe.com	102
PID 2200 wrote to memory of 2008	2200	Velavi.exe.com	102
PID 2200 wrote to memory of 2008	2200	Velavi.exe.com	102
PID 2200 wrote to memory of 2008	2200	Velavi.exe.com	102
PID 2200 wrote to memory of 2008	2200	Velavi.exe.com	102
PID 3468 wrote to memory of 780	3468	Rivederlo.exe.com	104
PID 3468 wrote to memory of 780	3468	Rivederlo.exe.com	104
PID 3468 wrote to memory of 780	3468	Rivederlo.exe.com	104

C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe
"C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Users\Admin\AppData\Local\Temp\is-CM581.tmp\BC8478F5CAA7B719234C8E1CF8395B12.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CM581.tmp\BC8478F5CAA7B719234C8E1CF8395B12.tmp" /SL5="$5006A,10346497,792064,C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe
    "C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe" /VERYSILENT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\is-8PL14.tmp\BC8478F5CAA7B719234C8E1CF8395B12.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8PL14.tmp\BC8478F5CAA7B719234C8E1CF8395B12.tmp" /SL5="$501E0,10346497,792064,C:\Users\Admin\AppData\Local\Temp\BC8478F5CAA7B719234C8E1CF8395B12.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2940
    - - C:\Program Files (x86)\My Program\SRBPolaris.exe
        
        "C:\Program Files (x86)\My Program\SRBPolaris.exe" C:\Program Files (x86)\My Program\SRBPolaris.exe
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1960
    - - C:\Program Files (x86)\My Program\driv.exe
        
        "C:\Program Files (x86)\My Program\driv.exe" C:\Program Files (x86)\My Program\driv.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\CCLI.exe
        
        "C:\Users\Admin\AppData\Local\Temp/CCLI.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Voi.dot
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^HXrmvNHDBkDgGNeExKVqLRIadYrxdOqbTpPwxrWDCUKCBwsXIMZofaNQgKpnJhhNkuxvYqpdOabRuyQgGuLEOSoBcZMJUbTfHXscHUZICJzXUWJoTV$" Mano.dot
        9⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Velavi.exe.com
        
        Velavi.exe.com c
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Velavi.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Velavi.exe.com c
        10⤵
        Executes dropped EXE
        Drops startup file
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2008
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        9⤵
        Runs ping.exe
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\ref.exe
        
        "C:\Users\Admin\AppData\Local\Temp/ref.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c cmd < Corano.aifc
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^LMdBvAYUmwcKFMhAjjYLBfAXPEJldHxpVjTUoafXpqEdNzGoOjdzbgUvjzMSROERGjPzTzsUXwCBKllvXAcrsqLHsbIPFbyxcMJAEhfxUcvcM$" Melagrani.aifc
        9⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Rivederlo.exe.com
        
        Rivederlo.exe.com A
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Rivederlo.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Rivederlo.exe.com A
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 30
        9⤵
        Runs ping.exe
        
        PID:2184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/780-229-0x0000000006400000-0x0000000006401000-memory.dmp

Download

memory/780-217-0x00000000003A0000-0x00000000003BE000-memory.dmp

Download

memory/780-222-0x0000000005160000-0x0000000005161000-memory.dmp

Download

memory/780-223-0x00000000024F0000-0x00000000024F1000-memory.dmp

Download

memory/780-226-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/780-227-0x0000000004E10000-0x0000000004E11000-memory.dmp

Download

memory/780-228-0x0000000005D00000-0x0000000005D01000-memory.dmp

Download

memory/1916-120-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1960-142-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-139-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-163-0x00007FFDB5DB0000-0x00007FFDB5DC0000-memory.dmp

Download

memory/1960-164-0x00007FFE34FD0000-0x00007FFE34FE0000-memory.dmp

Download

memory/1960-165-0x0000000000CA0000-0x0000000000CA2000-memory.dmp

Download

memory/1960-161-0x00007FFE34E50000-0x00007FFE34E60000-memory.dmp

Download

memory/1960-148-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-147-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-160-0x00007FFE34E50000-0x00007FFE34E60000-memory.dmp

Download

memory/1960-159-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-145-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-150-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-158-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-146-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-144-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-157-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-143-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-156-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-180-0x0000000000CA2000-0x0000000000CA4000-memory.dmp

Download

memory/1960-141-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-182-0x0000000000CA4000-0x0000000000CA5000-memory.dmp

Download

memory/1960-140-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-162-0x00007FF686430000-0x00007FF6870B0000-memory.dmp

Download

memory/1960-149-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-155-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-138-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-154-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-153-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-137-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-136-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-135-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-152-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-151-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-134-0x00007FF685300000-0x00007FF6856D1000-memory.dmp

Download

memory/1960-133-0x00007FFE34DA0000-0x00007FFE34DB0000-memory.dmp

Download

memory/1960-199-0x0000000000CA5000-0x0000000000CA7000-memory.dmp

Download

memory/2008-214-0x0000000006280000-0x0000000006281000-memory.dmp

Download

memory/2008-215-0x00000000065F0000-0x00000000065F1000-memory.dmp

Download

memory/2008-209-0x0000000005410000-0x0000000005411000-memory.dmp

Download

memory/2008-213-0x0000000005E90000-0x0000000005E91000-memory.dmp

Download

memory/2008-212-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/2008-211-0x0000000004F10000-0x000000000540E000-memory.dmp

Download

memory/2008-204-0x0000000000740000-0x000000000078E000-memory.dmp

Download

memory/2008-210-0x0000000005020000-0x0000000005021000-memory.dmp

Download

memory/2200-202-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/2940-124-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/3468-216-0x00000000011A0000-0x000000000124E000-memory.dmp

Download

memory/3944-114-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/4012-119-0x0000000000400000-0x00000000004CF000-memory.dmp

Download