Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 03:49
Behavioral task
behavioral1
Sample
Redline_20_2_crack/Kurome.Builder/stub.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Redline_20_2_crack/Kurome.Builder/stub.exe
Resource
win10v2004-20221111-en
General
-
Target
Redline_20_2_crack/Kurome.Builder/stub.exe
-
Size
96KB
-
MD5
625ed01fd1f2dc43b3c2492956fddc68
-
SHA1
48461ef33711d0080d7c520f79a0ec540bda6254
-
SHA256
6824c2c92eb7cee929f9c6b91e75c8c1fc3bfe80495eba4fa27118d40ad82b2b
-
SHA512
1889c7cee50092fe7a66469eb255b4013624615bac3a9579c4287bf870310bdc9018b0991f0ad7a9227c79c9bd08fd0c6fc7ebe97f21c16b7c06236f3755a665
-
SSDEEP
1536:9G6ijoigzKqO1RUTBHQsu/0igR4vYVVlmbfaxv0ujXyyedOn4iwEEl:BSElHQ/ORUYos0ujyzdZl
Malware Config
Extracted
xworm
194.145.138.85:1604
Iom8xb4NUaLbxykI
-
install_file
USB.exe
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-54-0x0000000000FC0000-0x0000000000FDE000-memory.dmp family_redline behavioral1/memory/1704-110-0x000000001E000000-0x000000001E142000-memory.dmp family_redline behavioral1/memory/1704-115-0x000000001E000000-0x000000001E142000-memory.dmp family_redline behavioral1/memory/1704-122-0x000000001E150000-0x000000001E292000-memory.dmp family_redline behavioral1/memory/1556-3926-0x000000001FB40000-0x000000001FB5A000-memory.dmp family_redline -
Executes dropped EXE 5 IoCs
Processes:
svchost.exePanel.exePanel.exesvchost.exePanel.exepid process 1808 svchost.exe 1704 Panel.exe 1556 Panel.exe 1892 svchost.exe 2064 Panel.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe -
Loads dropped DLL 9 IoCs
Processes:
Kurome.Host.exePanel.exepid process 1820 Kurome.Host.exe 1820 Kurome.Host.exe 1820 Kurome.Host.exe 1820 Kurome.Host.exe 1820 Kurome.Host.exe 1820 Kurome.Host.exe 896 Panel.exe 1232 1232 -
Suspicious use of NtSetInformationThreadHideFromDebugger 59 IoCs
Processes:
Panel.exePanel.exepid process 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe -
Drops file in Windows directory 1 IoCs
Processes:
Kurome.Loader.exedescription ioc process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll Kurome.Loader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
Panel.exePanel.exePanel.exepid process 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 1556 Panel.exe 1556 Panel.exe 1704 Panel.exe 1704 Panel.exe 1556 Panel.exe 1704 Panel.exe 1556 Panel.exe 2064 Panel.exe 1704 Panel.exe 1556 Panel.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
stub.exeAUDIODG.EXEKurome.Loader.exeKurome.Host.exesvchost.exePanel.exePanel.exesvchost.exePanel.exedescription pid process Token: SeDebugPrivilege 1988 stub.exe Token: 33 1352 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1352 AUDIODG.EXE Token: 33 1352 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1352 AUDIODG.EXE Token: SeDebugPrivilege 1884 Kurome.Loader.exe Token: SeDebugPrivilege 1820 Kurome.Host.exe Token: SeDebugPrivilege 1808 svchost.exe Token: SeDebugPrivilege 1704 Panel.exe Token: SeDebugPrivilege 1556 Panel.exe Token: SeDebugPrivilege 1892 svchost.exe Token: SeDebugPrivilege 2064 Panel.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Panel.exePanel.exePanel.exedescription pid process target process PID 896 wrote to memory of 1808 896 Panel.exe svchost.exe PID 896 wrote to memory of 1808 896 Panel.exe svchost.exe PID 896 wrote to memory of 1808 896 Panel.exe svchost.exe PID 896 wrote to memory of 1704 896 Panel.exe Panel.exe PID 896 wrote to memory of 1704 896 Panel.exe Panel.exe PID 896 wrote to memory of 1704 896 Panel.exe Panel.exe PID 1704 wrote to memory of 1556 1704 Panel.exe Panel.exe PID 1704 wrote to memory of 1556 1704 Panel.exe Panel.exe PID 1704 wrote to memory of 1556 1704 Panel.exe Panel.exe PID 1468 wrote to memory of 1892 1468 Panel.exe svchost.exe PID 1468 wrote to memory of 1892 1468 Panel.exe svchost.exe PID 1468 wrote to memory of 1892 1468 Panel.exe svchost.exe PID 1468 wrote to memory of 2064 1468 Panel.exe Panel.exe PID 1468 wrote to memory of 2064 1468 Panel.exe Panel.exe PID 1468 wrote to memory of 2064 1468 Panel.exe Panel.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Builder\stub.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Builder\stub.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5701⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Loader\Kurome.Loader.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Loader\Kurome.Loader.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.Host\Kurome.Host.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Panel.exe"C:\ProgramData\Panel.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Panel.exe"C:\ProgramData\Panel.exe" "--monitor"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Panel\RedLine_20_2\Panel\Panel.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Panel.exe"C:\ProgramData\Panel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
C:\ProgramData\svchost.exeFilesize
41KB
MD521e34fd43f1a7ddd77f5771db0747b96
SHA115316c29c2e2160121a162300d11ec0892ba0098
SHA256e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
SHA5129dbc4b0f964d5a266fca2ab85381b2d2c1de61b4004c8102810acfc4d6d771d4d6a91f41a919514beca7df6651cb261825e901d9f9211b8ab1c1dd5c8b67b75b
-
C:\ProgramData\svchost.exeFilesize
41KB
MD521e34fd43f1a7ddd77f5771db0747b96
SHA115316c29c2e2160121a162300d11ec0892ba0098
SHA256e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
SHA5129dbc4b0f964d5a266fca2ab85381b2d2c1de61b4004c8102810acfc4d6d771d4d6a91f41a919514beca7df6651cb261825e901d9f9211b8ab1c1dd5c8b67b75b
-
C:\ProgramData\svchost.exeFilesize
41KB
MD521e34fd43f1a7ddd77f5771db0747b96
SHA115316c29c2e2160121a162300d11ec0892ba0098
SHA256e5fd962cfc545edc3c5fb1442e50d4ede4e8ff4b57c805c09047df3ed8481547
SHA5129dbc4b0f964d5a266fca2ab85381b2d2c1de61b4004c8102810acfc4d6d771d4d6a91f41a919514beca7df6651cb261825e901d9f9211b8ab1c1dd5c8b67b75b
-
C:\Users\Admin\AppData\Local\Temp\Redline_20_2_crack\Kurome.LoaderMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\ProgramData\Panel.exeFilesize
4.8MB
MD55e8f0034b3a0563aeb3e8f0adf8c0382
SHA129b169831887a2964291f46b8f8948c360391d1b
SHA2566a56e775736588d2ea9e7a2a78c568c8553083799c0af9a772344858c96ff5d5
SHA512b8726272f567bfbba3021c590725e4608655c1c9fa7b7a4dcc6926540c4b7f6e3a2802492bb558db3a8d74ca5a473a77f37c81e8d20ea9edbbf1cfeba225d5ab
-
\ProgramData\Panel.exeFilesize
6.5MB
MD5a5d4b56185854220c27cc9eafd867e96
SHA1d11e688754b0eac8da0e478387f63bf759245775
SHA2560780b005ac79493f5e7f89e81dd9c7f7c05b7fd966f1e75156abbc8a4a5c02ba
SHA5121975d4bf5df91d3c22c337ca3fde4589c04fc9aa1ffe12cf989f6e891de100e666abfc0b713bb40503845c100c382f601adc047005fe79364abea822e92f0286
-
\ProgramData\Panel.exeFilesize
9.3MB
MD5f4e19b67ef27af1434151a512860574e
SHA156304fc2729974124341e697f3b21c84a8dd242a
SHA256c7a8709013ada38fc2e1ceb3b15631f2aea8e156eb3f0aa197e02df1259a493a
SHA512a92e73d58c51bb74618987f06166f52a65ed1525410aec1b8e377ea8547c1123e313e13e305310f7a750c4561756d87ff558670bf4df8b62ea874d6f7c14ca77
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllFilesize
3.4MB
MD5059d51f43f1a774bc5aa76d19c614670
SHA1171329bf0f48190cf4d59ce106b139e63507457d
SHA2562eaf3d548927ebd243362f7bcb906bb1bbff3961223fb9521cb2846b6b8d523d
SHA512a299cb18c8a47fc27c46db0011266b7fa273852b302374eb98a54034e1281150af8e54e58f76a384d3b92fbcb1a67fc0452cabe592a379e15cce2c5f9a4b6cb7
-
memory/896-88-0x000007FEFB561000-0x000007FEFB563000-memory.dmpFilesize
8KB
-
memory/896-87-0x000000001BDC0000-0x000000001BF3A000-memory.dmpFilesize
1.5MB
-
memory/896-86-0x00000000002C0000-0x000000000035C000-memory.dmpFilesize
624KB
-
memory/896-85-0x000000001B770000-0x000000001BAD2000-memory.dmpFilesize
3.4MB
-
memory/896-84-0x0000000000EE0000-0x000000000184E000-memory.dmpFilesize
9.4MB
-
memory/1556-3934-0x00000000211C0000-0x0000000021234000-memory.dmpFilesize
464KB
-
memory/1556-3930-0x00000000207E0000-0x00000000207F2000-memory.dmpFilesize
72KB
-
memory/1556-2143-0x000000001AD9E000-0x000000001ADBD000-memory.dmpFilesize
124KB
-
memory/1556-2044-0x000000001B0F0000-0x000000001B290000-memory.dmpFilesize
1.6MB
-
memory/1556-3927-0x0000000020080000-0x0000000020686000-memory.dmpFilesize
6.0MB
-
memory/1556-3928-0x0000000020690000-0x0000000020792000-memory.dmpFilesize
1.0MB
-
memory/1556-3929-0x00000000207A0000-0x00000000207DE000-memory.dmpFilesize
248KB
-
memory/1556-3926-0x000000001FB40000-0x000000001FB5A000-memory.dmpFilesize
104KB
-
memory/1556-3931-0x0000000020820000-0x0000000020832000-memory.dmpFilesize
72KB
-
memory/1556-3932-0x0000000020AC0000-0x0000000020AFA000-memory.dmpFilesize
232KB
-
memory/1556-2013-0x0000000000000000-mapping.dmp
-
memory/1556-4105-0x0000000020B30000-0x0000000020B80000-memory.dmpFilesize
320KB
-
memory/1556-3933-0x0000000020BB0000-0x0000000020C60000-memory.dmpFilesize
704KB
-
memory/1556-4031-0x000000001AD9E000-0x000000001ADBD000-memory.dmpFilesize
124KB
-
memory/1556-4056-0x0000000020D60000-0x0000000020DAA000-memory.dmpFilesize
296KB
-
memory/1704-102-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1704-182-0x000000001F840000-0x000000001F8D2000-memory.dmpFilesize
584KB
-
memory/1704-96-0x000007FEF4230000-0x000007FEF4C1C000-memory.dmpFilesize
9.9MB
-
memory/1704-98-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1704-97-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1704-100-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1704-2386-0x000000001AD8E000-0x000000001ADAD000-memory.dmpFilesize
124KB
-
memory/1704-104-0x0000000180000000-0x0000000180005000-memory.dmpFilesize
20KB
-
memory/1704-108-0x000000001E000000-0x000000001E142000-memory.dmpFilesize
1.3MB
-
memory/1704-110-0x000000001E000000-0x000000001E142000-memory.dmpFilesize
1.3MB
-
memory/1704-115-0x000000001E000000-0x000000001E142000-memory.dmpFilesize
1.3MB
-
memory/1704-122-0x000000001E150000-0x000000001E292000-memory.dmpFilesize
1.3MB
-
memory/1704-124-0x000000001B1E0000-0x000000001B380000-memory.dmpFilesize
1.6MB
-
memory/1704-141-0x000000001DD50000-0x000000001DD5A000-memory.dmpFilesize
40KB
-
memory/1704-139-0x000000001DD50000-0x000000001DD5A000-memory.dmpFilesize
40KB
-
memory/1704-152-0x000000001DD60000-0x000000001DD6A000-memory.dmpFilesize
40KB
-
memory/1704-145-0x000000001DD50000-0x000000001DD5A000-memory.dmpFilesize
40KB
-
memory/1704-143-0x000000001DD50000-0x000000001DD5A000-memory.dmpFilesize
40KB
-
memory/1704-153-0x000007FEF2A70000-0x000007FEF2B9C000-memory.dmpFilesize
1.2MB
-
memory/1704-155-0x000000001DD60000-0x000000001DD6A000-memory.dmpFilesize
40KB
-
memory/1704-156-0x000000001DD60000-0x000000001DD6A000-memory.dmpFilesize
40KB
-
memory/1704-158-0x000000001EDC0000-0x000000001F2BE000-memory.dmpFilesize
5.0MB
-
memory/1704-94-0x0000000000000000-mapping.dmp
-
memory/1704-323-0x000000001AD8E000-0x000000001ADAD000-memory.dmpFilesize
124KB
-
memory/1704-181-0x000000001E120000-0x000000001E13C000-memory.dmpFilesize
112KB
-
memory/1808-92-0x0000000000BB0000-0x0000000000BC0000-memory.dmpFilesize
64KB
-
memory/1808-168-0x000000001B660000-0x000000001B8EC000-memory.dmpFilesize
2.5MB
-
memory/1808-163-0x0000000001FC0000-0x0000000002024000-memory.dmpFilesize
400KB
-
memory/1808-89-0x0000000000000000-mapping.dmp
-
memory/1820-70-0x0000000004E50000-0x0000000004FCA000-memory.dmpFilesize
1.5MB
-
memory/1820-73-0x0000000000AD0000-0x0000000000AE2000-memory.dmpFilesize
72KB
-
memory/1820-81-0x0000000005DC0000-0x0000000005E10000-memory.dmpFilesize
320KB
-
memory/1820-66-0x0000000004AE0000-0x0000000004E42000-memory.dmpFilesize
3.4MB
-
memory/1820-80-0x0000000005D80000-0x0000000005DA8000-memory.dmpFilesize
160KB
-
memory/1820-79-0x0000000005C40000-0x0000000005D4A000-memory.dmpFilesize
1.0MB
-
memory/1820-78-0x0000000005B60000-0x0000000005C2E000-memory.dmpFilesize
824KB
-
memory/1820-77-0x0000000005140000-0x000000000518B000-memory.dmpFilesize
300KB
-
memory/1820-76-0x00000000058D0000-0x0000000005B5C000-memory.dmpFilesize
2.5MB
-
memory/1820-75-0x0000000001360000-0x00000000013C4000-memory.dmpFilesize
400KB
-
memory/1820-74-0x00000000012D0000-0x000000000130E000-memory.dmpFilesize
248KB
-
memory/1820-82-0x0000000005E10000-0x0000000005F12000-memory.dmpFilesize
1.0MB
-
memory/1820-72-0x00000000052C0000-0x00000000058C6000-memory.dmpFilesize
6.0MB
-
memory/1820-60-0x00000000013D0000-0x00000000013F4000-memory.dmpFilesize
144KB
-
memory/1820-71-0x0000000000810000-0x0000000000836000-memory.dmpFilesize
152KB
-
memory/1820-83-0x0000000005FA0000-0x0000000005FD0000-memory.dmpFilesize
192KB
-
memory/1884-58-0x0000000007690000-0x0000000007CA0000-memory.dmpFilesize
6.1MB
-
memory/1884-56-0x00000000000E0000-0x0000000000316000-memory.dmpFilesize
2.2MB
-
memory/1892-3936-0x0000000000000000-mapping.dmp
-
memory/1988-54-0x0000000000FC0000-0x0000000000FDE000-memory.dmpFilesize
120KB
-
memory/1988-55-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB
-
memory/2064-3938-0x0000000000000000-mapping.dmp
-
memory/2064-3953-0x000000001B280000-0x000000001B420000-memory.dmpFilesize
1.6MB
-
memory/2064-4032-0x000000001AF2E000-0x000000001AF4D000-memory.dmpFilesize
124KB