redline | hxxps://samples[.]vx-underground[.]org/Archive/Builders/Redline%20Stealer%20Builder[.]7z

Analysis

max time kernel
2041s
max time network
2048s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30-11-2024 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://samples.vx-underground.org/Archive/Builders/Redline%20Stealer%20Builder.7z

Score

10^/10

redline discovery infostealer persistence privilege_escalation

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/files/0x002800000004523c-733.dat	family_redline
behavioral1/memory/4452-735-0x00000000007F0000-0x0000000000894000-memory.dmp	family_redline
behavioral1/files/0x00030000000443f4-736.dat	family_redline
behavioral1/memory/4452-739-0x00000000051C0000-0x00000000051EA000-memory.dmp	family_redline
behavioral1/memory/4452-782-0x0000000005700000-0x000000000570E000-memory.dmp	family_redline
behavioral1/memory/4452-783-0x0000000005980000-0x00000000059AA000-memory.dmp	family_redline

Redline family
redline
Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4488	7z2409-x64.exe
3464	7zG.exe
4452	RedLine.MainPanel-cracked.exe

Loads dropped DLL 32 IoCs

pid	Process
3632	Process not Found
3464	7zG.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe
4452	RedLine.MainPanel-cracked.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241130192117.pma	setup.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2409-x64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RedLine.MainPanel-cracked.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 664007.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
4840	msedge.exe
4840	msedge.exe
3684	msedge.exe
3684	msedge.exe
456	identity_helper.exe
456	identity_helper.exe
4740	msedge.exe
4740	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
884	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	3464	7zG.exe
Token: 35	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeSecurityPrivilege	3464	7zG.exe
Token: SeDebugPrivilege	4452	RedLine.MainPanel-cracked.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
3464	7zG.exe
4452	RedLine.MainPanel-cracked.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4488	7z2409-x64.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
884	OpenWith.exe
4356	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1948	4840	msedge.exe	81
PID 4840 wrote to memory of 1948	4840	msedge.exe	81
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2128	4840	msedge.exe	82
PID 4840 wrote to memory of 2172	4840	msedge.exe	83
PID 4840 wrote to memory of 2172	4840	msedge.exe	83
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84
PID 4840 wrote to memory of 1612	4840	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://samples.vx-underground.org/Archive/Builders/Redline%20Stealer%20Builder.7z
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde84d46f8,0x7ffde84d4708,0x7ffde84d4718
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0x7ff7f0185460,0x7ff7f0185470,0x7ff7f0185480
    3⤵
    PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6768 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:4720
- C:\Users\Admin\Downloads\7z2409-x64.exe
  "C:\Users\Admin\Downloads\7z2409-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17092783060855862437,17452774484197470634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1108

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4488

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap11073:102:7zEvent22260
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3464

C:\Users\Admin\Desktop\Redline Stealer\RedLine.MainPanel-cracked.exe
"C:\Users\Admin\Desktop\Redline Stealer\RedLine.MainPanel-cracked.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
843402bd30bd238629acedf42a0dcb51

SHA1
050e6aa6f2c5b862c224e5852cdfb84db9a79bbc

SHA256
692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a

SHA512
977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
557df060b24d910f788843324c70707a

SHA1
e5d15be40f23484b3d9b77c19658adcb6e1da45c

SHA256
83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

SHA512
78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6350a023-1a6e-4db6-be4c-0e607b77eae9.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
63019f07465ca0c5bd3446cbce7cfb06

SHA1
925cc728c3e771f06705aa617a9d31e1ddffc859

SHA256
a0c29134028acf5179756347d3908c99e4d2ff990ab0562117c8b35aa97dae06

SHA512
bd00ce04536b7e51254496e180e0a5b9d5e01a294541cd0993135b470d926c16d0d895c7972e15c69da8eac4bb1a2192a2b14b9cf66a8252d17b99302f8f8bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
da392f8cb7cfbcb50d2a592a3d0fa261

SHA1
349566eb0bfb1c8c1f2fc0a8a8e4157f27e949ec

SHA256
289422f028a8f26e4fee12e225ed0fc7e59f8342113a7d8f274a27506415e707

SHA512
428a3214d1f84edae79b7b41b5d91595f885bf8a5edba665f46f5ecf3176430ddef3e4feff28449d8f275199a157abad158c62debd525e3286649b9cfdc3073b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
986B

MD5
6b78864beb3476958a3f45b05566ba54

SHA1
523962fe69beeeb80a42d625ced87ae792cda9a0

SHA256
27c5533c1ffb7b0a95750c3576198775847c4e5100e129b322fea13d4707ae45

SHA512
07a48b0d7131ef22e03226a762425f25558c89f74e40d94a9b77ab1789e570efc27b9e0c48ddf6b72b591dcdbcfc39fe75d1af43e8a4a3c391a75e7eb4df3c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71c00f9668979f9d2d93a0766db84921

SHA1
f8be0c401acd99a1306c5573248d1374e4cdb149

SHA256
7cd5542b92ce009a78fdc9e9079acdc0f34e8634efd1cbd9a262d433e3985a53

SHA512
7154eb780d6a3bb7e3497b3e665dcdaa3afd5a04681e1ac11cb8b73365b31a7815583d52ee40579b2a667522de1aa49f4230169cfc02a9ee6798b7efd5814317

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00a350c60656b234158dcc99d96e4982

SHA1
a093934db79e4e3ecd81c954b4e77be568288acf

SHA256
313254fa0f05253c8a262a7e104a29cc8c86c22516560012550e2b4c7b08de19

SHA512
1af9406cdac07db6c9aa48df288b9732d8f86c573327a34cec319da897d1a8990ee72dba9a70a51ce1a44d2ec09d9815e4e36c9b5883d24813aaabf99f912b37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73043c94b73e7c9b7ac1afbd87aef46f

SHA1
f1d2235d9883b6537e78a22570e958e04094011f

SHA256
fc8c5b49bf504c9d53e77dd5172501743d928a3bcd47ecaf83b5b6804b2a8102

SHA512
4ae8de355230a23263fd9690777dac9875f7ec50a55b9d57f1cb6ff409ca48da636ba8629ad230949007b597a3cecd92bb5accc63add534fa06fbaacce534036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67a114be560d9255b9ec9e4833e3f602

SHA1
1c532848fd722003d30379119e6c39b5dd111d10

SHA256
833811e61c298b530969cf05f6f87d3bc24513a786580f21237a273c1dbf8006

SHA512
ce50ea338886ad6561e2be996d79494b66123b62ab202c77a39e3315eaf654c308bef9d769bf31ae528e18a7c959a344952efdcccba5c55fbdf2fe9a09e82973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
edd5a356e51531a4b37fa78d8af7eeef

SHA1
5bed6f08d5844c760cbee1eeb40c0b59147e1ced

SHA256
63bce97075ff28fc144f77b2544cf051baf71012373ef10e957df352629059a9

SHA512
a426c7be13d75cc0dcf45d7ebdf9a0be0d47f2fdefccd616d45ed17c6dcc74c08c8760e274735553690132e8e595333055f0f78951a1a2f2a5e780a48891c5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
74d9eb5260fef5b115bec73a0af9ac54

SHA1
18862574f0044f4591a2c3cf156db8f237787acf

SHA256
7d7e7b38664d625a0bbffbcb7882b175709e92987bf9da113c4745fafbbc361d

SHA512
b85917201b1d4b4542a4424ce40ddd083ddbd0e230e1931fe6f7cdd2aa3d8a0eec8daa743ddc5467f0a92da5594144c602081d941b216ca9cafdfd3c150d32d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
952a6e3cbc50f011cf2f04c9470080ff

SHA1
a0d6a2509af73e523c970f6e4351861bde63d6db

SHA256
faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f

SHA512
7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
9c462e33fcedbc153bae2de4127ca20b

SHA1
309b78d98a8b7a771380554b5c97f17132a46173

SHA256
178d2631ef3aed87e1991cc53f9b2deb60065da100f3da356756ff597612dd18

SHA512
179b9ccf14fea7b9ec028724a6f1f89d28da9b0cb9b40fe8b843db129fc0605cdcc6db6df22fc2502f55fbadf73bf6d460e244c3beaab023e99ce5ceae8c53d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584cf2.TMP

Filesize
538B

MD5
f7a05ac7c649f75c64323cb15b0e840c

SHA1
cd21eb0ed9eb70c916173869d2cedead059ca65a

SHA256
122264ee62167c7cc2f79eb740c0c7730295d6acee86a1dea32ec542b945ce7e

SHA512
bceb4d2880d8b8d637fa4362c5a74a21554351522c1bc7f1e432b741dcbe0fa971bd40d1a856974d505233aae7a26a83c3b0f1413a41556f80248b01d285727d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
51d4472149c2759e22839c85aa933b1b

SHA1
2ebd8b6c7a34d948609d064dd99cf304e29da9cf

SHA256
a0d66c5cc5c58ffb14dc2f368254ac8e37f974c21fabf679d6be17c43ef7f998

SHA512
99274f40901e132f2f4546c4a928e2474b13fcebadfa21d1612f09b87baa6d02fb74de1c7895027529cebdf28362d58e54f6fa4858f8ea75078d1bf84053d382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6841826af44fbccff3395ed04f7f43d0

SHA1
f643b2b4f0ac45cb129c7b2f146bb35e6645e844

SHA256
8ffd48a08224696f90c21d657386a6fbd02ac793f1eb5867576b60f4460bb5f5

SHA512
17ce28595775dc96dca1dd5a0de7cd27781f9ed6c943bcde8f6fa77cafa04e94633c6dce443e5339c74b373bd531bbe1ee633e1075567033d4ac91654caae028

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
78cab078e7a59b2083262b501fba409d

SHA1
b40f3dfd016c4d319f5262ebc57877e065949e91

SHA256
125cd002d78792359f258ce9ef7c685fc9ce2b4414972c64c5917408872c3380

SHA512
8a1b983389b5afcecda6228d90d1f8fb9531731b08d4808b884e3e910403c9ea7dd7412041dc87994b21692c02eeb4fe2bffc08b32b7ec5af9ebf5617cb7a0e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
47e980f8970f4d25e3cddd24e0132c69

SHA1
aa46eb7fb5d66807e27b4731bac29f45a5321729

SHA256
a6e5394a709a2e7b9f4b7a752728f6c6da883f05214834e21d6fd7bf2bdaeb72

SHA512
54dbecc896cb6afa7ef471ee76f5cc0f13ae9191be3934d90549ee2afd59bc422ba2e672826f701b1ba1fa99dd2a300c53537c0534be6f0184ef0c5e5b34310b

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Build.exe

Filesize
141KB

MD5
1035bbf6b782b7a8819fa9bc616a9657

SHA1
e24f76eeaa29637aedd374f0087492d24aca22eb

SHA256
4060699be22d52cd3753fa0bb8d3147a7b14b4ee9769013f2f0ad284586911cb

SHA512
fb6ca81949db5bdf70ad294d68e3af534cb5e823558ac9428712a04d68b4b7413b00e3e465ad09e0e19572c777b6de7decaf705df3394177ba5792ec274e06d9

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Bunifu_UI_v1.52.dll

Filesize
219KB

MD5
5eca94d909f1ba4c5f3e35ac65a49076

SHA1
3b9cb69510887117844464a2cc711c06f2c3bd19

SHA256
de0e530d46c803d85b8aeb6d18816f1b09cb3dafefb5e19fdfa15c9f41e0f474

SHA512
257a33c748dfb617a7e2892310132fd4abf4384fb09c93a8ac3f609fd91353a4f3e326124ecc63b6041ac87cf4fcc17a8bdca312e0c851acd9c7a182247066ea

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\GuiLib.dll

Filesize
50KB

MD5
eaf9c55793cd26f133708714ed3a5397

SHA1
1818aa718498f0810199eca2b91db300dc24f902

SHA256
87cfc70bec2d2a37bcd5d46f9e6f0051f82e015ff96e8f2bc2d81b85f2632f15

SHA512
b793ae1155bd7be247b42c0fc1bc53e34cf69e802c0e365427322dac4b5cc68728d24255a717aaffa774b4551a6946c17106387cff4cfdb6ce638d8a4ecab4d9

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\MetroSet UI.dll

Filesize
436KB

MD5
f13dc3cffef729d26c4da102674561cf

SHA1
5f9abff0bdf305e33b578c22dada5c87b2f6f39c

SHA256
d490c04e6e89462fd46099d3454985f319f57032176c67403b3b92c86ca58bcb

SHA512
aa8699c5f608a10a577cb23715f761ee28922c4778f5ea8a5ec0a184e1143689fba5a08003fd5cbf3c7dd516eac1fddc8c3f9efa1d993ba1888e87b70190c08f

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Mdb.dll

Filesize
42KB

MD5
dc80f588f513d998a5df1ca415edb700

SHA1
e2f0032798129e461f0d2494ae14ea7a4f106467

SHA256
90cfc73befd43fc3fd876e23dcc3f5ce6e9d21d396bbb346513302e2215db8c9

SHA512
1b3e57fbc10f109a43e229b5010d348e2786e12ddf48a757da771c97508f8f3891be3118ff3bb84c3fd6bfa1723c670541667cdbf2d14ea63243f6def8f038cc

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Mdb.pdb

Filesize
18KB

MD5
0ba762b6b5fbda000e51d66722a3bb2c

SHA1
260f9c873831096e92128162cc4dfcc5c2ba9785

SHA256
d18eb89421d50f079291b78783408cee4bab6810e4c5a4b191849265bdd5ba7c

SHA512
03496dce05c0841888802005c75d5b94ac5ca3aa88d754230b6f4619861e58c0492c814805cde104dc7071e2860ebc90a7fba402c65a0397fb519c57fca982f7

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Pdb.dll

Filesize
87KB

MD5
6cd3ed3db95d4671b866411db4950853

SHA1
528b69c35a5e36cc8d747965c9e5ea0dc40323b8

SHA256
d67ebd49241041e6b6191703a90d89e68d4465adce02c595218b867df34581a3

SHA512
e8ae4caf214997cc440e684a963727934741fd616a073365fa1fc213c5ca336c12e117d7fa0d6643600a820297fc11a21e4ac3c11613fba612b90ebd5fc4c07e

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Pdb.pdb

Filesize
25KB

MD5
8e07476db3813903e596b669d3744855

SHA1
964a244772ee23c31f9e79477fbccfd8ed9437e6

SHA256
aa6469974d04cba872f86e6598771663bb8721d43a4a0a2a44cf3e2cd2f1e646

SHA512
715e7f4979142a96b04f8cb2ffa4a1547cd509eb05cf73f0885de533d60fd43d0c5bba9c051871fd38d503cb61fe1a0ee24350f25d89476fbc3b794f0ff9998f

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Rocks.dll

Filesize
27KB

MD5
c8f36848ce8f13084b355c934fc91746

SHA1
8f60c2fd1f6f5b5f365500b2749dca8c845f827a

SHA256
a08c040912df2a3c823ade85d62239d56abaa8f788a2684fb9d33961922687c7

SHA512
7c47f96e0e7dfaebb4dccf99fa0dda64c608634e2521798fd0d4c74eb2641c848fadad29c2cd26eb9b45acdfef791752959117a59e1f0913f9092e4662075115

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.Rocks.pdb

Filesize
8KB

MD5
17e3ccb3a96be6d93ca3c286ca3b93dc

SHA1
d6e2f1edc52bbef4d6d2c63c837a024d6483bbb3

SHA256
ca54d2395697efc3163016bbc2bb1e91b13d454b9a5a3ee9a4304012f012e5eb

SHA512
08c4fc7b9a7609aca8d1f7c7cd1b8c859c198d3d4e7cad012a6f9b5490afff04a330c46f3429d61e3a5570c82855deda64a0308b899f8e2f93f66ed50f7fad3b

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.dll

Filesize
337KB

MD5
7546acebc5a5213dee2a5ed18d7ebc6c

SHA1
b964d242c0778485322ccb3a3b7c25569c0718b7

SHA256
7744c9c84c28033bc3606f4dfce2adcd6f632e2be7827893c3e2257100f1cf9e

SHA512
30b3a001550dca88c8effc9e8107442560ee1f42e3d2f354cc2813ae9030bf872c76dc211fd12778385387be5937e9bf172ea00c151cab0bca77c8aafdd11f7d

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Mono.Cecil.pdb

Filesize
172KB

MD5
c0a69f1b0c50d4f133cd0b278ac2a531

SHA1
bcefbe60c18318f21ba53377a386733e9266c37d

SHA256
a4f79c99d8923bd6c30efafa39363c18babe95f6609bbad242bca44342ccc7bb

SHA512
c38b0b08e7d37f31ab4331fcc54033ec181dc399e39df602869846f53e3dc006425a81b7b08f352c5e54501e247657364dfc288085a7c1c552737d4db4f33406

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\Newtonsoft.Json.dll

Filesize
683KB

MD5
6815034209687816d8cf401877ec8133

SHA1
1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

SHA256
7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

SHA512
3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\builder.exe

Filesize
11KB

MD5
de6f68cdf350fce9be13803d84be98c4

SHA1
e37ec52f68ab48344579ccbfc4d2d90d3073c808

SHA256
51bbc69942823b84c2a1f0efdb9d63fb04612b223e86af8a83b4b307dd15cd24

SHA512
0344b764dc0a615d5a0bbb24ba442bd857d69fd3b102f243dafc9a9ae8776f6ad98f9af2cf680effaa5807451e310232224264ce9fe1bbc4a5f826833705ee8a

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\Libraries\builder.pdb

Filesize
33KB

MD5
418dc008ef956465e179ec29d3c3c245

SHA1
4960b2952c6cc8de2295f145c3a4526bf6d1a391

SHA256
8c7e21b37540211d56c5fdbb7e731655a96945aa83f2988e33d5adb8aa7c8df1

SHA512
ad386b6cf99682d117dce3a38c37f45843ac87d9ad17608453c0dfe8dd2b74c0c19c46a35da8140dc3ffc61d2333d78ab1438723cfd74aac585c39f0f59542f2

Download Submit
C:\Users\Admin\Desktop\Redline Stealer\RedLine.MainPanel-cracked.exe

Filesize
633KB

MD5
baf102927947289e4d589028620ce291

SHA1
5ade9a99a86e5558e5353afa7844229ed23bdcd5

SHA256
a6d2d1ba6765e5245b0f62e37d9298e20c913c5a33912b98bd65a76fc5ab28ae

SHA512
973ecb034ba18a74c85165df743d9d87168b07539c8ef1d60550171bc0a5766a10b9e6be1425aea203be45b4175694a489ea1b7837faa3b1927ca019492ccd37

Download Submit
C:\Users\Admin\Downloads\Redline Stealer Builder.7z

Filesize
1.6MB

MD5
3317523fcb65de0cad16632d204adf2c

SHA1
8d68b943b791774933acfc6a9b4e6a1e018b2439

SHA256
4f758849cc2c1a02baf4c275ea8fc9cc2fd9a380c157d066a984162fd43cbfe3

SHA512
df0a952becbd4925aa14a1d54dc8ac4b6519043d19960daad27b99f0fc83eeaa07a1dee53b3f0e582d3db0a5012cbbbb6ad67037347f79cb0717c756eb92a796

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 664007.crdownload

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
memory/4452-783-0x0000000005980000-0x00000000059AA000-memory.dmp

Filesize
168KB

Download
memory/4452-780-0x00000000058D0000-0x0000000005980000-memory.dmp

Filesize
704KB

Download
memory/4452-739-0x00000000051C0000-0x00000000051EA000-memory.dmp

Filesize
168KB

Download
memory/4452-735-0x00000000007F0000-0x0000000000894000-memory.dmp

Filesize
656KB

Download
memory/4452-764-0x0000000005630000-0x0000000005640000-memory.dmp

Filesize
64KB

Download
memory/4452-775-0x00000000056B0000-0x00000000056BE000-memory.dmp

Filesize
56KB

Download
memory/4452-748-0x0000000005670000-0x00000000056AE000-memory.dmp

Filesize
248KB

Download
memory/4452-760-0x0000000005720000-0x000000000577A000-memory.dmp

Filesize
360KB

Download
memory/4452-782-0x0000000005700000-0x000000000570E000-memory.dmp

Filesize
56KB

Download
memory/4452-781-0x0000000005870000-0x00000000058BA000-memory.dmp

Filesize
296KB

Download
memory/4452-756-0x00000000057A0000-0x0000000005814000-memory.dmp

Filesize
464KB

Download
memory/4452-784-0x0000000005C30000-0x0000000005EE0000-memory.dmp

Filesize
2.7MB

Download
memory/4452-785-0x0000000005820000-0x000000000583A000-memory.dmp

Filesize
104KB

Download
memory/4452-743-0x00000000051A0000-0x00000000051AA000-memory.dmp

Filesize
40KB

Download
memory/4452-786-0x0000000006490000-0x0000000006A36000-memory.dmp

Filesize
5.6MB

Download
memory/4452-787-0x0000000005A60000-0x0000000005AF2000-memory.dmp

Filesize
584KB

Download
memory/4452-752-0x0000000005650000-0x0000000005662000-memory.dmp

Filesize
72KB

Download
memory/4452-770-0x00000000056D0000-0x00000000056EC000-memory.dmp

Filesize
112KB

Download
memory/4452-788-0x0000000007060000-0x0000000007678000-memory.dmp

Filesize
6.1MB

Download
memory/4452-789-0x0000000005EF0000-0x0000000005EFA000-memory.dmp

Filesize
40KB

Download
memory/4452-790-0x0000000008400000-0x0000000008412000-memory.dmp

Filesize
72KB

Download
memory/4452-791-0x0000000008460000-0x000000000849C000-memory.dmp

Filesize
240KB

Download
memory/4452-792-0x00000000084A0000-0x00000000084EC000-memory.dmp

Filesize
304KB

Download
memory/4452-793-0x000000000B350000-0x000000000B45A000-memory.dmp

Filesize
1.0MB

Download
memory/4452-795-0x000000000B2F0000-0x000000000B340000-memory.dmp

Filesize
320KB

Download
memory/4452-794-0x000000000B270000-0x000000000B298000-memory.dmp

Filesize
160KB

Download
memory/4452-809-0x00000000011B0000-0x000000000124C000-memory.dmp

Filesize
624KB

Download