redline | 158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71

Resubmissions

29-10-2024 12:12

241029-pdnz6swngp 10

02-04-2023 23:18

230402-3anrwsbe84 10

Analysis

max time kernel
49s
max time network
147s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
02-04-2023 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
Size

666KB
MD5

79c42acfef4f418e432e9e9b6a31da51
SHA1

bb7537c905b5eedd84951dc2ce2bc11cbe2185ad
SHA256

158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71
SHA512

d851e28e22a4ab6d4e41c6a404a9e16f4dae6d5f409c16a640c382eeb1c108cef01a052bdd9f844a7d00b5ec367f73204517c4946b55e40e997144cf9e738e70
SSDEEP

12288:YMrqy90Jhv0JVYrjHPfQx7mq74n7DdPxCo27rU0/L/wLFk5+IR3SSc:yyANv3QxCW47DdpCZ7rFTwxkwy3nc

Score

10^/10

redline rosn spora discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

176.113.115.145:4125

Attributes

auth_value
441b39ab37774b2ca9931c31e1bc6071

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pro6248.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/4772-177-0x0000000004CE0000-0x0000000004D26000-memory.dmp	family_redline
behavioral1/memory/4772-178-0x0000000004D70000-0x0000000004DB4000-memory.dmp	family_redline
behavioral1/memory/4772-179-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-180-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-182-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-184-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-186-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-188-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-190-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-192-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-194-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-196-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-198-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-200-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-202-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-204-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-206-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-208-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-210-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline
behavioral1/memory/4772-212-0x0000000004D70000-0x0000000004DAF000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
352	un215760.exe
3444	pro6248.exe
4772	qu7671.exe
4320	si453170.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pro6248.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pro6248.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un215760.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un215760.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3444	pro6248.exe
3444	pro6248.exe
4772	qu7671.exe
4772	qu7671.exe
4320	si453170.exe
4320	si453170.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	pro6248.exe
Token: SeDebugPrivilege	4772	qu7671.exe
Token: SeDebugPrivilege	4320	si453170.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 352	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	66
PID 3480 wrote to memory of 352	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	66
PID 3480 wrote to memory of 352	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	66
PID 352 wrote to memory of 3444	352	un215760.exe	67
PID 352 wrote to memory of 3444	352	un215760.exe	67
PID 352 wrote to memory of 3444	352	un215760.exe	67
PID 352 wrote to memory of 4772	352	un215760.exe	68
PID 352 wrote to memory of 4772	352	un215760.exe	68
PID 352 wrote to memory of 4772	352	un215760.exe	68
PID 3480 wrote to memory of 4320	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	70
PID 3480 wrote to memory of 4320	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	70
PID 3480 wrote to memory of 4320	3480	158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe	70

C:\Users\Admin\AppData\Local\Temp\158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe
"C:\Users\Admin\AppData\Local\Temp\158692a7c2bd29a8bda1a166b8a0cf66a0f84d587c696b940de63cb63a848e71.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si453170.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si453170.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si453170.exe

Filesize
176KB

MD5
fb9fcd0dc7e0ae46a15c1efd158cbc04

SHA1
a588ecea4adb0e82f6987d79718c0640dda89594

SHA256
70bca50d138df6e96447627a305a3d996502a7d61bc6cb774263d9974dc4e2f3

SHA512
f0c7aa0a33a9ed99fd84b1bdf8b0d862148493f3cf25a836d164a55729b9d80d69ee29372d0b0488147933d650bdca52302797639d5d0af33f1f157d42e7e908

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si453170.exe

Filesize
176KB

MD5
fb9fcd0dc7e0ae46a15c1efd158cbc04

SHA1
a588ecea4adb0e82f6987d79718c0640dda89594

SHA256
70bca50d138df6e96447627a305a3d996502a7d61bc6cb774263d9974dc4e2f3

SHA512
f0c7aa0a33a9ed99fd84b1bdf8b0d862148493f3cf25a836d164a55729b9d80d69ee29372d0b0488147933d650bdca52302797639d5d0af33f1f157d42e7e908

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe

Filesize
524KB

MD5
6755745bb38839fdf65af281bd969f00

SHA1
2f30b2583e3d93a8e314fb6b226c5f52b0364908

SHA256
09166615f7e43b8a529089d6a4206421a431a7079635574a3aecefc25b316787

SHA512
8cf1e61d159c0ddc3621d452275d512d84585115fe15c7d440fefe7980c9b52aadb6a0fd8b106abfb69dac3b4aadb5ea1384c9234f47a80b162f39d3ffa28751

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un215760.exe

Filesize
524KB

MD5
6755745bb38839fdf65af281bd969f00

SHA1
2f30b2583e3d93a8e314fb6b226c5f52b0364908

SHA256
09166615f7e43b8a529089d6a4206421a431a7079635574a3aecefc25b316787

SHA512
8cf1e61d159c0ddc3621d452275d512d84585115fe15c7d440fefe7980c9b52aadb6a0fd8b106abfb69dac3b4aadb5ea1384c9234f47a80b162f39d3ffa28751

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe

Filesize
294KB

MD5
9f4a43f973f56c272b93f3467e932ed0

SHA1
d0e6057849e49e23196cf7f2fa09fb84862e8b8e

SHA256
5c0129a963a3b4ff5857aff4ed1b732eb0cab3d9448049cca2bd2afad4ddee1f

SHA512
eda601937fc2ff739fbeaa8219c0b9077ec73bdc2ca698116ac5a46e127167aadbd025e9ce8fe83c47078f33caf39774caca91a6669ac1e0750add650531f465

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6248.exe

Filesize
294KB

MD5
9f4a43f973f56c272b93f3467e932ed0

SHA1
d0e6057849e49e23196cf7f2fa09fb84862e8b8e

SHA256
5c0129a963a3b4ff5857aff4ed1b732eb0cab3d9448049cca2bd2afad4ddee1f

SHA512
eda601937fc2ff739fbeaa8219c0b9077ec73bdc2ca698116ac5a46e127167aadbd025e9ce8fe83c47078f33caf39774caca91a6669ac1e0750add650531f465

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe

Filesize
352KB

MD5
618f6727e66ea87de6664ed6a989f81b

SHA1
e746378f2de3712225f2845834317d093085708f

SHA256
7880157d41d14177ee0e91874d91de189acac98ffbd0c8fb05ca1919ae233247

SHA512
93b0ca94f646b0650245e980a46d7b3aff643b4221150ecfdc9ed95471db445a6f0f503f106461b39ef83f607e665833c8ac24cf29063b8f6a0a0e807554b27c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu7671.exe

Filesize
352KB

MD5
618f6727e66ea87de6664ed6a989f81b

SHA1
e746378f2de3712225f2845834317d093085708f

SHA256
7880157d41d14177ee0e91874d91de189acac98ffbd0c8fb05ca1919ae233247

SHA512
93b0ca94f646b0650245e980a46d7b3aff643b4221150ecfdc9ed95471db445a6f0f503f106461b39ef83f607e665833c8ac24cf29063b8f6a0a0e807554b27c

Download Submit
memory/3444-132-0x0000000000B10000-0x0000000000B2A000-memory.dmp

Filesize
104KB

Download
memory/3444-133-0x0000000004D60000-0x000000000525E000-memory.dmp

Filesize
5.0MB

Download
memory/3444-134-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/3444-137-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-136-0x0000000002790000-0x00000000027A8000-memory.dmp

Filesize
96KB

Download
memory/3444-138-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-135-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-139-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-140-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-142-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-144-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-146-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-148-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-150-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-152-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-154-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-156-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-158-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-160-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-162-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-164-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-166-0x0000000002790000-0x00000000027A2000-memory.dmp

Filesize
72KB

Download
memory/3444-167-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/3444-168-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-169-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-170-0x0000000004D50000-0x0000000004D60000-memory.dmp

Filesize
64KB

Download
memory/3444-172-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download
memory/4320-1111-0x0000000000520000-0x0000000000552000-memory.dmp

Filesize
200KB

Download
memory/4320-1113-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/4320-1112-0x0000000004F60000-0x0000000004FAB000-memory.dmp

Filesize
300KB

Download
memory/4772-179-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-300-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-182-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-184-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-186-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-188-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-190-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-192-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-194-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-196-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-198-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-200-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-202-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-204-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-206-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-208-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-210-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-212-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-299-0x0000000000A50000-0x0000000000A9B000-memory.dmp

Filesize
300KB

Download
memory/4772-180-0x0000000004D70000-0x0000000004DAF000-memory.dmp

Filesize
252KB

Download
memory/4772-305-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-303-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-1089-0x00000000053D0000-0x00000000059D6000-memory.dmp

Filesize
6.0MB

Download
memory/4772-1090-0x00000000059E0000-0x0000000005AEA000-memory.dmp

Filesize
1.0MB

Download
memory/4772-1091-0x0000000005AF0000-0x0000000005B02000-memory.dmp

Filesize
72KB

Download
memory/4772-1092-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-1093-0x0000000005B10000-0x0000000005B4E000-memory.dmp

Filesize
248KB

Download
memory/4772-1094-0x0000000005C60000-0x0000000005CAB000-memory.dmp

Filesize
300KB

Download
memory/4772-1095-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Filesize
408KB

Download
memory/4772-1097-0x00000000064B0000-0x0000000006542000-memory.dmp

Filesize
584KB

Download
memory/4772-1098-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-1099-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-1100-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4772-1101-0x0000000006690000-0x0000000006706000-memory.dmp

Filesize
472KB

Download
memory/4772-1102-0x0000000006720000-0x0000000006770000-memory.dmp

Filesize
320KB

Download
memory/4772-178-0x0000000004D70000-0x0000000004DB4000-memory.dmp

Filesize
272KB

Download
memory/4772-177-0x0000000004CE0000-0x0000000004D26000-memory.dmp

Filesize
280KB

Download
memory/4772-1103-0x0000000006780000-0x0000000006942000-memory.dmp

Filesize
1.8MB

Download
memory/4772-1104-0x0000000006950000-0x0000000006E7C000-memory.dmp

Filesize
5.2MB

Download
memory/4772-1105-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download