redline | 993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c

Analysis

max time kernel
112s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe
Size

699KB
MD5

df75224ce8c94d6563b58dec1cacef86
SHA1

724a711058eaa0cc113598d0ea1ddc9b4fc9b696
SHA256

993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c
SHA512

94123418742d09f516bfd4d698ab195585495d7f3ef8906026343badbe2e6f4594e35a0c96c303ea28c6ff661009d3c5f45f8fd633a0ae6c470988e35fc47d22
SSDEEP

12288:5MrYy90llsV3oW/LyP21LmdIv3G5jOQMb2iG8vZrM8NwPIzLL9rFtATrO7F:JyZ3/LU29j3G5jOXb2iGyrM8NAIfL9Zd

Score

10^/10

redline from rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

176.113.115.145:4125

Attributes

auth_value
8633e283485822a4a48f0a41d5397566

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro7936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro7936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro7936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro7936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro7936.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pro7936.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/1496-190-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-191-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-193-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-195-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-197-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-199-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-201-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-203-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-205-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-207-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-209-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-211-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-213-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-215-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-217-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-219-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-223-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline
behavioral1/memory/1496-227-0x0000000002680000-0x00000000026BF000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3488	un141548.exe
4344	pro7936.exe
1496	qu6627.exe
1668	si554038.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro7936.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro7936.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un141548.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un141548.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3732	4344	WerFault.exe	84
3956	1496	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4344	pro7936.exe
4344	pro7936.exe
1496	qu6627.exe
1496	qu6627.exe
1668	si554038.exe
1668	si554038.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	pro7936.exe
Token: SeDebugPrivilege	1496	qu6627.exe
Token: SeDebugPrivilege	1668	si554038.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3488	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	83
PID 2724 wrote to memory of 3488	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	83
PID 2724 wrote to memory of 3488	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	83
PID 3488 wrote to memory of 4344	3488	un141548.exe	84
PID 3488 wrote to memory of 4344	3488	un141548.exe	84
PID 3488 wrote to memory of 4344	3488	un141548.exe	84
PID 3488 wrote to memory of 1496	3488	un141548.exe	93
PID 3488 wrote to memory of 1496	3488	un141548.exe	93
PID 3488 wrote to memory of 1496	3488	un141548.exe	93
PID 2724 wrote to memory of 1668	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	97
PID 2724 wrote to memory of 1668	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	97
PID 2724 wrote to memory of 1668	2724	993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe	97

C:\Users\Admin\AppData\Local\Temp\993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe
"C:\Users\Admin\AppData\Local\Temp\993c3acf5ee675bc5242f9d91f6774b6be155f8bcd7f9ad06d1f0cb90bcf3f7c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un141548.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un141548.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7936.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7936.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 1080
      4⤵
      Program crash
      PID:3732
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6627.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 1328
      4⤵
      Program crash
      PID:3956
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si554038.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si554038.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4344 -ip 4344
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1496 -ip 1496
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si554038.exe

Filesize
175KB

MD5
57fb5fa5c92fa19afa778c7445088bf6

SHA1
ea4954c988a992eddba06468732c21235642ad5f

SHA256
baddbff3d5816bbef93ff687cb02d7b52b19dae20f7e76dc573614e12316ad25

SHA512
a3d38720613374d8dbc7ccc640d376452093c978b9d3bf88ca84048d4ca83eba90804a8a90668c3be378fa04c647b00ba83c8ef8301b6429f111e012363ad580

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si554038.exe

Filesize
175KB

MD5
57fb5fa5c92fa19afa778c7445088bf6

SHA1
ea4954c988a992eddba06468732c21235642ad5f

SHA256
baddbff3d5816bbef93ff687cb02d7b52b19dae20f7e76dc573614e12316ad25

SHA512
a3d38720613374d8dbc7ccc640d376452093c978b9d3bf88ca84048d4ca83eba90804a8a90668c3be378fa04c647b00ba83c8ef8301b6429f111e012363ad580

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un141548.exe

Filesize
557KB

MD5
1ec7322e52428634473814742222009e

SHA1
def3d60e64fd10db2108149388f732f1aa0a28db

SHA256
e43633f49a54524157f72051176865dd8797d443170a037a2678a59564f99313

SHA512
36dafcf42b41af15423785cdfba45915b7b70c423b7a005e8c833ec66db6216cfbb1a7584dadfd3d28e664bac5bace4c3b5168583dbc7fe7433bb0d01eaa65c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un141548.exe

Filesize
557KB

MD5
1ec7322e52428634473814742222009e

SHA1
def3d60e64fd10db2108149388f732f1aa0a28db

SHA256
e43633f49a54524157f72051176865dd8797d443170a037a2678a59564f99313

SHA512
36dafcf42b41af15423785cdfba45915b7b70c423b7a005e8c833ec66db6216cfbb1a7584dadfd3d28e664bac5bace4c3b5168583dbc7fe7433bb0d01eaa65c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7936.exe

Filesize
307KB

MD5
c7b546883e7e44013356444c18ac72ff

SHA1
cdbc4a526c2a26c878041078273ef04d42ab1395

SHA256
792b58aaf6de605938fa0a539901edc32e48170041c32dfffa3b2a5e43161a4b

SHA512
71e54fb06ec845d0d17af674e4932113027bfa048a8b86f569f0efe641d7e8777810ae746cb1388b1340c61d2e1962f937dc405e3d17cb39d1d84151a994844d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7936.exe

Filesize
307KB

MD5
c7b546883e7e44013356444c18ac72ff

SHA1
cdbc4a526c2a26c878041078273ef04d42ab1395

SHA256
792b58aaf6de605938fa0a539901edc32e48170041c32dfffa3b2a5e43161a4b

SHA512
71e54fb06ec845d0d17af674e4932113027bfa048a8b86f569f0efe641d7e8777810ae746cb1388b1340c61d2e1962f937dc405e3d17cb39d1d84151a994844d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6627.exe

Filesize
366KB

MD5
43d312b7c7232963012d42a200eb7e5d

SHA1
9f2187d665b3bd54e342c11ffbdda6589e7f762c

SHA256
674568d2c1b7201b07c81697e5ef70dcc72298747017fc100f3264e263a54b9e

SHA512
c181fa3b29ea113c08e40b2424533e3894f82b1f3d51be4e2e41f455cd7359093b7adf0e77c3de4bba81011d05931e674ca993c3d71101167bcad8b49c425930

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6627.exe

Filesize
366KB

MD5
43d312b7c7232963012d42a200eb7e5d

SHA1
9f2187d665b3bd54e342c11ffbdda6589e7f762c

SHA256
674568d2c1b7201b07c81697e5ef70dcc72298747017fc100f3264e263a54b9e

SHA512
c181fa3b29ea113c08e40b2424533e3894f82b1f3d51be4e2e41f455cd7359093b7adf0e77c3de4bba81011d05931e674ca993c3d71101167bcad8b49c425930

Download Submit
memory/1496-227-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-1102-0x0000000005B00000-0x0000000005B12000-memory.dmp

Filesize
72KB

Download
memory/1496-1115-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-1114-0x00000000070F0000-0x0000000007140000-memory.dmp

Filesize
320KB

Download
memory/1496-1113-0x0000000007060000-0x00000000070D6000-memory.dmp

Filesize
472KB

Download
memory/1496-1112-0x00000000069F0000-0x0000000006F1C000-memory.dmp

Filesize
5.2MB

Download
memory/1496-1111-0x0000000006810000-0x00000000069D2000-memory.dmp

Filesize
1.8MB

Download
memory/1496-1110-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-1109-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-1108-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-1106-0x00000000064E0000-0x0000000006572000-memory.dmp

Filesize
584KB

Download
memory/1496-1105-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/1496-1104-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-1103-0x0000000005B20000-0x0000000005B5C000-memory.dmp

Filesize
240KB

Download
memory/1496-1101-0x0000000004DE0000-0x0000000004EEA000-memory.dmp

Filesize
1.0MB

Download
memory/1496-1100-0x00000000054D0000-0x0000000005AE8000-memory.dmp

Filesize
6.1MB

Download
memory/1496-224-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-225-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-223-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-222-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/1496-221-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/1496-219-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-190-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-191-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-193-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-195-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-197-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-199-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-201-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-203-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-205-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-207-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-209-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-211-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-213-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-215-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1496-217-0x0000000002680000-0x00000000026BF000-memory.dmp

Filesize
252KB

Download
memory/1668-1121-0x0000000000650000-0x0000000000682000-memory.dmp

Filesize
200KB

Download
memory/1668-1122-0x0000000005290000-0x00000000052A0000-memory.dmp

Filesize
64KB

Download
memory/4344-173-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-179-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-182-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4344-181-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4344-150-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4344-180-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/4344-171-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-153-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-177-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-175-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-183-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4344-151-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/4344-161-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-167-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-165-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-163-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-169-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-159-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-157-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-155-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download
memory/4344-149-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/4344-148-0x0000000004D70000-0x0000000005314000-memory.dmp

Filesize
5.6MB

Download
memory/4344-185-0x0000000000400000-0x0000000000710000-memory.dmp

Filesize
3.1MB

Download
memory/4344-152-0x0000000005370000-0x0000000005382000-memory.dmp

Filesize
72KB

Download