Overview
overview
10Static
static
10Redline_20...er.exe
windows7-x64
1Redline_20...er.exe
windows10-2004-x64
1Redline_20...db.dll
windows7-x64
1Redline_20...db.dll
windows10-2004-x64
1Redline_20...db.dll
windows7-x64
1Redline_20...db.dll
windows10-2004-x64
1Redline_20...ks.dll
windows7-x64
1Redline_20...ks.dll
windows10-2004-x64
1Redline_20...il.dll
windows7-x64
1Redline_20...il.dll
windows10-2004-x64
1Redline_20...ld.exe
windows7-x64
10Redline_20...ld.exe
windows10-2004-x64
10Redline_20...ub.exe
windows7-x64
10Redline_20...ub.exe
windows10-2004-x64
10Redline_20...st.exe
windows7-x64
1Redline_20...st.exe
windows10-2004-x64
1Redline_20...CF.dll
windows7-x64
1Redline_20...CF.dll
windows10-2004-x64
1Redline_20...er.exe
windows7-x64
4Redline_20...er.exe
windows10-2004-x64
4Redline_20...xe.xml
windows7-x64
1Redline_20...xe.xml
windows10-2004-x64
1Redline_20...).docx
windows7-x64
4Redline_20...).docx
windows10-2004-x64
1Redline_20...).docx
windows7-x64
4Redline_20...).docx
windows10-2004-x64
1Redline_20...el.exe
windows7-x64
10Redline_20...el.exe
windows10-2004-x64
10Redline_20...me.exe
windows7-x64
8Redline_20...me.exe
windows10-2004-x64
8Redline_20...48.exe
windows7-x64
8Redline_20...48.exe
windows10-2004-x64
8Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-01-2023 03:33
Behavioral task
behavioral1
Sample
Redline_20_2_crack/Kurome.Builder/Kurome.Builder.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Redline_20_2_crack/Kurome.Builder/Kurome.Builder.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Mdb.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Mdb.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Pdb.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Pdb.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Rocks.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.Rocks.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.dll
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
Redline_20_2_crack/Kurome.Builder/Mono.Cecil.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
Redline_20_2_crack/Kurome.Builder/build.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
Redline_20_2_crack/Kurome.Builder/build.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
Redline_20_2_crack/Kurome.Builder/stub.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
Redline_20_2_crack/Kurome.Builder/stub.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Redline_20_2_crack/Kurome.Host/Kurome.Host.exe
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Redline_20_2_crack/Kurome.Host/Kurome.Host.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
Redline_20_2_crack/Kurome.Host/Kurome.WCF.dll
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Redline_20_2_crack/Kurome.Host/Kurome.WCF.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
Redline_20_2_crack/Kurome.Loader/Kurome.Loader.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Redline_20_2_crack/Kurome.Loader/Kurome.Loader.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Redline_20_2_crack/Kurome.Loader/Kurome.Loader.exe.xml
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Redline_20_2_crack/Kurome.Loader/Kurome.Loader.exe.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
Redline_20_2_crack/Panel/RedLine_20_2/FAQ (English).docx
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Redline_20_2_crack/Panel/RedLine_20_2/FAQ (English).docx
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Redline_20_2_crack/Panel/RedLine_20_2/FAQ(RUS).docx
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Redline_20_2_crack/Panel/RedLine_20_2/FAQ(RUS).docx
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Panel/Panel.exe
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Panel/Panel.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Tools/Chrome.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Tools/Chrome.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Tools/NetFramework48.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Redline_20_2_crack/Panel/RedLine_20_2/Tools/NetFramework48.exe
Resource
win10v2004-20221111-en
General
-
Target
Redline_20_2_crack/Panel/RedLine_20_2/Panel/Panel.exe
-
Size
9.4MB
-
MD5
c708571970a5df0ac078d6926b4a0233
-
SHA1
30587f2e1b2200fb371c5d2edf79174f9e1d831f
-
SHA256
6a8bb8bb4e7eba4e87afb75f058b3489fc17f5858fc712678dd44ba9574dc088
-
SHA512
472e88d5009d4b9701b8d3654d3820b57ae4e9ccda2f3fd70e6230c4b8aca51bc58eb2b0d4583b4b5b888a66a94cd462c6f642e02da260b92558d3cfabc6e6fc
-
SSDEEP
196608:cIS8FZi3v80O6qRvXvkmJ0QsTsKpmnssE3ruVL2V9z:c0KFr4/v9J0zpBuVw
Malware Config
Extracted
xworm
194.145.138.85:1604
Iom8xb4NUaLbxykI
-
install_file
USB.exe
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral27/memory/1748-77-0x000000001E010000-0x000000001E152000-memory.dmp family_redline behavioral27/memory/1748-82-0x000000001E010000-0x000000001E152000-memory.dmp family_redline behavioral27/memory/1748-90-0x000000001E160000-0x000000001E2A2000-memory.dmp family_redline behavioral27/memory/1748-126-0x000000001E160000-0x000000001E2A2000-memory.dmp family_redline behavioral27/memory/1268-3889-0x000000001F230000-0x000000001F24A000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
svchost.exePanel.exePanel.exepid process 948 svchost.exe 1748 Panel.exe 1268 Panel.exe 1204 -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
Panel.exepid process 1932 Panel.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 59 IoCs
Processes:
Panel.exePanel.exepid process 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe 1268 Panel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Panel.exePanel.exepid process 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe 1748 Panel.exe 1268 Panel.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exePanel.exePanel.exedescription pid process Token: SeDebugPrivilege 948 svchost.exe Token: SeDebugPrivilege 1748 Panel.exe Token: SeDebugPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe Token: SeIncBasePriorityPrivilege 1268 Panel.exe Token: 33 1268 Panel.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Panel.exePanel.exedescription pid process target process PID 1932 wrote to memory of 948 1932 Panel.exe svchost.exe PID 1932 wrote to memory of 948 1932 Panel.exe svchost.exe PID 1932 wrote to memory of 948 1932 Panel.exe svchost.exe PID 1932 wrote to memory of 1748 1932 Panel.exe Panel.exe PID 1932 wrote to memory of 1748 1932 Panel.exe Panel.exe PID 1932 wrote to memory of 1748 1932 Panel.exe Panel.exe PID 1748 wrote to memory of 1268 1748 Panel.exe Panel.exe PID 1748 wrote to memory of 1268 1748 Panel.exe Panel.exe PID 1748 wrote to memory of 1268 1748 Panel.exe Panel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Panel.exe"C:\ProgramData\Panel.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Panel.exe"C:\ProgramData\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\svchost.exeFilesize
41KB
MD521e34fd43f1a7ddd77f5771db0747b96
SHA115316c29c2e2160121a162300d11ec0892ba0098
SHA256e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
SHA5129dbc4b0f964d5a266fca2ab85381b2d2c1de61b4004c8102810acfc4d6d771d4d6a91f41a919514beca7df6651cb261825e901d9f9211b8ab1c1dd5c8b67b75b
-
C:\ProgramData\svchost.exeFilesize
41KB
MD521e34fd43f1a7ddd77f5771db0747b96
SHA115316c29c2e2160121a162300d11ec0892ba0098
SHA256e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
SHA5129dbc4b0f964d5a266fca2ab85381b2d2c1de61b4004c8102810acfc4d6d771d4d6a91f41a919514beca7df6651cb261825e901d9f9211b8ab1c1dd5c8b67b75b
-
\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
memory/948-56-0x0000000000000000-mapping.dmp
-
memory/948-59-0x0000000000A00000-0x0000000000A10000-memory.dmpFilesize
64KB
-
memory/1268-3894-0x000000001B0E0000-0x000000001B280000-memory.dmpFilesize
1.6MB
-
memory/1268-3895-0x0000000020060000-0x00000000200AA000-memory.dmpFilesize
296KB
-
memory/1268-3893-0x000000001F770000-0x000000001F7E4000-memory.dmpFilesize
464KB
-
memory/1268-3892-0x000000001F5C0000-0x000000001F670000-memory.dmpFilesize
704KB
-
memory/1268-3891-0x000000001F4D0000-0x000000001F50A000-memory.dmpFilesize
232KB
-
memory/1268-3890-0x000000001F470000-0x000000001F482000-memory.dmpFilesize
72KB
-
memory/1268-3889-0x000000001F230000-0x000000001F24A000-memory.dmpFilesize
104KB
-
memory/1268-2085-0x000000001AD8E000-0x000000001ADAD000-memory.dmpFilesize
124KB
-
memory/1268-1990-0x000000001B0E0000-0x000000001B280000-memory.dmpFilesize
1.6MB
-
memory/1268-3897-0x000000001AD8E000-0x000000001ADAD000-memory.dmpFilesize
124KB
-
memory/1268-1975-0x0000000000000000-mapping.dmp
-
memory/1748-69-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1748-82-0x000000001E010000-0x000000001E152000-memory.dmpFilesize
1.3MB
-
memory/1748-110-0x000000001DD80000-0x000000001DD8A000-memory.dmpFilesize
40KB
-
memory/1748-112-0x000000001DD80000-0x000000001DD8A000-memory.dmpFilesize
40KB
-
memory/1748-119-0x000000001E110000-0x000000001E11A000-memory.dmpFilesize
40KB
-
memory/1748-120-0x000007FEF6A20000-0x000007FEF6B4C000-memory.dmpFilesize
1.2MB
-
memory/1748-122-0x000000001E110000-0x000000001E11A000-memory.dmpFilesize
40KB
-
memory/1748-123-0x000000001E110000-0x000000001E11A000-memory.dmpFilesize
40KB
-
memory/1748-124-0x000000001E110000-0x000000001E11A000-memory.dmpFilesize
40KB
-
memory/1748-126-0x000000001E160000-0x000000001E2A2000-memory.dmpFilesize
1.3MB
-
memory/1748-145-0x000000001E140000-0x000000001E15C000-memory.dmpFilesize
112KB
-
memory/1748-265-0x000000001AE4E000-0x000000001AE6D000-memory.dmpFilesize
124KB
-
memory/1748-106-0x000000001DD80000-0x000000001DD8A000-memory.dmpFilesize
40KB
-
memory/1748-90-0x000000001E160000-0x000000001E2A2000-memory.dmpFilesize
1.3MB
-
memory/1748-88-0x000000001B1A0000-0x000000001B340000-memory.dmpFilesize
1.6MB
-
memory/1748-108-0x000000001DD80000-0x000000001DD8A000-memory.dmpFilesize
40KB
-
memory/1748-77-0x000000001E010000-0x000000001E152000-memory.dmpFilesize
1.3MB
-
memory/1748-2083-0x000000001AE4E000-0x000000001AE6D000-memory.dmpFilesize
124KB
-
memory/1748-75-0x000000001E010000-0x000000001E152000-memory.dmpFilesize
1.3MB
-
memory/1748-71-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1748-64-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1748-3901-0x000000001AE93000-0x000000001AE97000-memory.dmpFilesize
16KB
-
memory/1748-65-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1748-67-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1748-63-0x000007FEF5D90000-0x000007FEF677C000-memory.dmpFilesize
9.9MB
-
memory/1748-61-0x0000000000000000-mapping.dmp
-
memory/1748-3900-0x000000001AE8F000-0x000000001AE93000-memory.dmpFilesize
16KB
-
memory/1748-3898-0x000000001AE8F000-0x000000001AE93000-memory.dmpFilesize
16KB
-
memory/1748-3899-0x000000001AE93000-0x000000001AE97000-memory.dmpFilesize
16KB
-
memory/1932-55-0x000007FEFBF21000-0x000007FEFBF23000-memory.dmpFilesize
8KB
-
memory/1932-54-0x0000000001130000-0x0000000001A9E000-memory.dmpFilesize
9.4MB