Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 20:19
Static task
static1
Behavioral task
behavioral1
Sample
Good.ps1
Resource
win7-20220812-en
General
-
Target
Good.ps1
-
Size
1KB
-
MD5
f352e9ea5b48e556410878e8204434f5
-
SHA1
3e6be512bdf272021faf840ce76d149631c322f5
-
SHA256
e05a116bf80f3d77481a9962caa9d0d8544f287dfd6b6c865054e8ea9c9f6826
-
SHA512
8d08c60a887dec659abfae2f10fadb426640d3e3a56394b18b382dd0c43759c6dd7504f6fe17a720cd7c412bf6f97ae8f9fb0940ee11b3a64891446218444b21
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
worldpassed.publicvm.com:199
AsyncMutex_6SI8OkBrC
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3660-186-0x000000000040DF0E-mapping.dmp asyncrat behavioral2/memory/3660-185-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 18 3512 powershell.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exeWScript.exemshta.execmd.exemshta.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1648 set thread context of 3660 1648 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3920 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
powershell.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3284 powershell.exe 3284 powershell.exe 3512 powershell.exe 3512 powershell.exe 4416 powershell.exe 4416 powershell.exe 4348 powershell.exe 4348 powershell.exe 4348 powershell.exe 2276 powershell.exe 2276 powershell.exe 1764 powershell.exe 1764 powershell.exe 1648 powershell.exe 1648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 3284 powershell.exe Token: SeDebugPrivilege 3512 powershell.exe Token: SeDebugPrivilege 4416 powershell.exe Token: SeDebugPrivilege 4348 powershell.exe Token: SeDebugPrivilege 3920 taskkill.exe Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 1648 powershell.exe Token: SeDebugPrivilege 3660 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
powershell.execmd.exepowershell.execmd.exeWScript.execmd.exepowershell.exemshta.execmd.exemshta.exeWScript.execmd.exeWScript.exeWScript.exepowershell.exedescription pid process target process PID 3284 wrote to memory of 4064 3284 powershell.exe cmd.exe PID 3284 wrote to memory of 4064 3284 powershell.exe cmd.exe PID 4064 wrote to memory of 3512 4064 cmd.exe powershell.exe PID 4064 wrote to memory of 3512 4064 cmd.exe powershell.exe PID 3512 wrote to memory of 4460 3512 powershell.exe cmd.exe PID 3512 wrote to memory of 4460 3512 powershell.exe cmd.exe PID 4460 wrote to memory of 4416 4460 cmd.exe powershell.exe PID 4460 wrote to memory of 4416 4460 cmd.exe powershell.exe PID 3512 wrote to memory of 756 3512 powershell.exe WScript.exe PID 3512 wrote to memory of 756 3512 powershell.exe WScript.exe PID 3512 wrote to memory of 1468 3512 powershell.exe schtasks.exe PID 3512 wrote to memory of 1468 3512 powershell.exe schtasks.exe PID 756 wrote to memory of 4664 756 WScript.exe cmd.exe PID 756 wrote to memory of 4664 756 WScript.exe cmd.exe PID 4664 wrote to memory of 4348 4664 cmd.exe powershell.exe PID 4664 wrote to memory of 4348 4664 cmd.exe powershell.exe PID 4348 wrote to memory of 3728 4348 powershell.exe cmstp.exe PID 4348 wrote to memory of 3728 4348 powershell.exe cmstp.exe PID 552 wrote to memory of 3088 552 mshta.exe cmd.exe PID 552 wrote to memory of 3088 552 mshta.exe cmd.exe PID 3088 wrote to memory of 1332 3088 cmd.exe WScript.exe PID 3088 wrote to memory of 1332 3088 cmd.exe WScript.exe PID 4092 wrote to memory of 3920 4092 mshta.exe taskkill.exe PID 4092 wrote to memory of 3920 4092 mshta.exe taskkill.exe PID 1332 wrote to memory of 484 1332 WScript.exe cmd.exe PID 1332 wrote to memory of 484 1332 WScript.exe cmd.exe PID 484 wrote to memory of 2276 484 cmd.exe powershell.exe PID 484 wrote to memory of 2276 484 cmd.exe powershell.exe PID 4692 wrote to memory of 1764 4692 WScript.exe powershell.exe PID 4692 wrote to memory of 1764 4692 WScript.exe powershell.exe PID 3464 wrote to memory of 1648 3464 WScript.exe powershell.exe PID 3464 wrote to memory of 1648 3464 WScript.exe powershell.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe PID 1648 wrote to memory of 3660 1648 powershell.exe aspnet_compiler.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Good.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell < C:\Users\Admin\AppData\Roaming/educational.png2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]]4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI [BYTe[]]5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\a.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\a.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\b.ps16⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmstp.exe"C:\Windows\system32\cmstp.exe" /au C:\Windows\temp\kvgse0yn.inf7⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn administartor /sc minute /st 00:10 /tr C:\Users\Admin\Favorites\System.vbs4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe /c start """""""" """"%USERPROFILE%\Favorites\Assembly.vbs"""""",0:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\Favorites\Assembly.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\Assembly.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\x.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\x.ps15⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""taskkill /IM cmstp.exe /F"", 0, true:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d336b18e0e02e045650ac4f24c7ecaa7
SHA187ce962bb3aa89fc06d5eb54f1a225ae76225b1c
SHA25687e250ac493525f87051f19207d735b28aa827d025f2865ffc40ba775db9fc27
SHA512e538e4ecf771db02745061f804a0db31f59359f32195b4f8c276054779509eaea63665adf6fedbb1953fa14eb471181eb085880341c7368330d8c3a26605bb18
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD557866c0b343808442b8657c28107e5cd
SHA1b131d901e867ca5a3de95ca3fc12b5a483137e31
SHA256232e6e16bb2f27daa78c8f60a34e6b2da4314cc004487c0b5b8ed0563d82fb73
SHA51245b9cb4901b36bb32ac1807a43f91b6e023a88ac3f92091051a0162bc275d21b850d6861f15caae188a8ac5c8d3fd9ef8cd8925afb230f4588208b1e449b59cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f388a8baa0d9cbd6aeb70596278c6c97
SHA1ca0b4c284f5e6968fa1c75829432de2734eafa1d
SHA2561a5deb9b8464f3e296529502c8dbe0c68ef605ad12487805eca52708eb038592
SHA512b75c02c49d87b5f4383223c5c8aa2942b67b09b02b3926f229f863b09b590883d9046962f0c7750b76d6fe9521c92ebafe10e6c341c195fbcd36be54dd600145
-
C:\Users\Admin\AppData\Roaming\educational.pngFilesize
251B
MD5292374cd21675135acb516497a730fd9
SHA1f6e019093fc9a0952b7ae2c536b0b9f37071d0bf
SHA25686cf5e4e86c0aae75158c04e13051275c341af7bf54b7a7cd49eced95d21b1b0
SHA512491623e21d1740e234925bf0d1df1ac6402404bbcbad1d3e926ebdca0eeb55e1ab2322d38c7501f28b0a8deda853e087bfc22f34ca9b63995428ba8a3c03da32
-
C:\Users\Admin\Favorites\Assembly.vbsFilesize
331B
MD566d268811c166c82aaef2f52450b0c73
SHA1f7810c1003732c440b986718a8217dd733e88f74
SHA256581df8170200c95d38ce78eba4e9942d47cad443bbc0148954e48df04eec3b34
SHA51236de3a5f59ee7a531832ae7e43997a3019ad8a15b0d1b321e589a85d77af27dab80b90a0ef5c978c4fffcc4d32fe8d870f60e9cf3e5bff302e4292bfc6196830
-
C:\Users\Admin\Favorites\System.vbsFilesize
121B
MD5dada8407cf4051919362d16a6d735cde
SHA18a2788926f97dbd59c99ad51b3383c59992c6c2e
SHA256ee512a4266049b505b2b5c6c4c7bd66baadd37eda61bfe7f31f6cfcc1c955a77
SHA51242c6b1fac8502e3b21cbd6cda11601afc55ca539db03667eec7c839bc33c70ed1a6aeba5a3c9684951143658b17183c2782bec8a0108b345c0ac2aebdaa8fc9f
-
C:\Users\Admin\Favorites\UAC-B.dllFilesize
11KB
MD5cc6ba6fc273dbfbb5c9698c0cf4719b9
SHA1a2b3433b728b0874ec69d8a629d5f0dd05c0946d
SHA256320316cdda2aa0e8709472a2b8eb8debcd0f8bb6f9af4d4d4b3bc67068ceebe7
SHA512fe2fe2f150fbf619dd7616c86c93a42446b7c915b92fb865971dcf7dd595c6483da7386ce40b99802dc0942068bd1703821e0e3b15a6ebe557619cf6fa413c61
-
C:\Users\Admin\Favorites\a.batFilesize
86B
MD54625a049cd6ea721b706699ab3c36dff
SHA1dbb82c9e8cb7bdcf617e7c4e158d031275b5ec24
SHA256c751a3cb67ab1c75f1de6e24b7193123cc815524c538973110d1f6027da24dc0
SHA51235674c3c1d6c449b3716ddf2ca8733e255a8f642723186a847694fb936b50a91e6bd7ab7f6edf1489592a583109739a4f0c12769823e2fc163860eeb7004b6c0
-
C:\Users\Admin\Favorites\a.vbsFilesize
485B
MD55ce49e20c572f2b6d4b43fc61a6906ec
SHA1170185b8ab9fc4749f28e5796999c23b50be89dc
SHA256d6a43aad0aa8e510f01409921c8b0b5c8d93d51d1f7f39340db775c164686412
SHA512c49e14c094e4d5e108aa50889a9fb06428a3d7a1f74d868c9b7d37f35658a64ea205b00681ad83aef428113fdf6fead8ef98dd1e6b38d84b8306765025c2e8e3
-
C:\Users\Admin\Favorites\b.ps1Filesize
173B
MD5e1d9cbc41ffacef02695df17824a82e0
SHA1970ae087b8a3d11fb3e2a9b8de1592a166436fa7
SHA25661571d1fd0000c02eef19b7dd6e452e2f9eba2e947f4c96d781e79d35802043f
SHA5123b4034b2072a309adeb1af8b540023791262915f4b1347f4aa27f8aedcbbb6e1126c1a4d5f1db1ce2ad5638d24d7ba3025a8451c291241db2f2a99b0832f620a
-
C:\Users\Admin\Favorites\micro.ps1Filesize
888KB
MD52c012c85dad2ed3845d3606fb4204d9d
SHA1aae41574a6a9fe13b8552a3aba61bc5a550d4161
SHA256ad4059af90d7d3a2690eef17d4fe45cc1d6b5b8c0ae806bc0d598e5a4838cd84
SHA5127d9da6e1f243a2bd55b7ce91d2657077268612cc176bc279e79fabedcd7cde740534d46289371759532e31676f62f76af602780f4f728437bc8344e62799873d
-
C:\Users\Admin\Favorites\micro.ps1Filesize
444KB
MD56c7473033862bc8f2d1ca5d2f64593a8
SHA1420a0f9508cf7a6e17ecb7670a9df7cbbb8c24d7
SHA25672842be7f7e16ffbb22c2646b18aa647537742782c2df530ad5076890743ea0e
SHA5122a9eda8fec9f0684bb2a8016868150a660181dabdfb29eec7a942ee4f843c63a854c42aaab2395e418dbb35be11134ec4ff5014e2daa4210bd891238d759f2f2
-
C:\Users\Admin\Favorites\x.batFilesize
86B
MD503fc58bceab448c9f183fbe86fed1f11
SHA107f3d54b0b40755e8f58f5fdab95049def6578e3
SHA2566062f0e764ccd855b61ba49720065dfd6f6c6864c4eb1e9dce95ba8a293fd756
SHA512c0e9aec7a6c5aaae3b018d44f1fbdc1939026ce16fad20211a0521e3db9e470d842508b7d2167672e1585bafeb4b2f1fe694ca96ddb9137ff9e5d3b4ca53ea4f
-
C:\Users\Admin\Favorites\x.ps1Filesize
567B
MD5e9859d3134c68db3134a6ca7df484344
SHA1f4eec5ee9aa11a82d19bdb78a174c574669fd1d8
SHA256a4aaf6c64969788732b20c79c1299719b84a52eddda13778a672195bbfba4a6c
SHA51247982ddf074418c350790f5f7d53edddbbb47e7768939ebf88f4812b01f241c8bff509dbd9a8e6232eb6ec7f8b0344a1a59474ea45da0c80af9f04ba21498cdb
-
C:\Windows\temp\kvgse0yn.infFilesize
834B
MD509c0056318d62ee84963c66ae83d6c1b
SHA1625936963d4a0059daff7222a1628198be9b7a4f
SHA25625b2a55bade39fe6d90e0fb06068062a95af522f62d743454ffa4ddd478781d8
SHA512b03301fcafbc905ac7724b5ee878208c4c7dc039b02edcfc00e51742c868ab4cf3f830dbbe52b314ee24f8d87f39b6c9eb3e6c188ddc75a9b52f7dfab85cb2d0
-
memory/484-168-0x0000000000000000-mapping.dmp
-
memory/756-147-0x0000000000000000-mapping.dmp
-
memory/1332-165-0x0000000000000000-mapping.dmp
-
memory/1468-148-0x0000000000000000-mapping.dmp
-
memory/1648-184-0x00007FF984A40000-0x00007FF985501000-memory.dmpFilesize
10.8MB
-
memory/1648-180-0x0000000000000000-mapping.dmp
-
memory/1648-187-0x00007FF984A40000-0x00007FF985501000-memory.dmpFilesize
10.8MB
-
memory/1648-183-0x00007FF984A40000-0x00007FF985501000-memory.dmpFilesize
10.8MB
-
memory/1764-179-0x00007FF984A40000-0x00007FF985501000-memory.dmpFilesize
10.8MB
-
memory/1764-175-0x0000000000000000-mapping.dmp
-
memory/1764-176-0x00007FF984A40000-0x00007FF985501000-memory.dmpFilesize
10.8MB
-
memory/2276-172-0x00007FF982DB0000-0x00007FF983871000-memory.dmpFilesize
10.8MB
-
memory/2276-173-0x00007FF982DB0000-0x00007FF983871000-memory.dmpFilesize
10.8MB
-
memory/2276-169-0x0000000000000000-mapping.dmp
-
memory/3088-162-0x0000000000000000-mapping.dmp
-
memory/3284-132-0x00000235F51B0000-0x00000235F51D2000-memory.dmpFilesize
136KB
-
memory/3284-133-0x00007FF984970000-0x00007FF985431000-memory.dmpFilesize
10.8MB
-
memory/3284-135-0x00007FF984970000-0x00007FF985431000-memory.dmpFilesize
10.8MB
-
memory/3512-140-0x0000029BBEA70000-0x0000029BBEAB4000-memory.dmpFilesize
272KB
-
memory/3512-141-0x0000029BBEEB0000-0x0000029BBEF26000-memory.dmpFilesize
472KB
-
memory/3512-139-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/3512-152-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/3512-137-0x0000000000000000-mapping.dmp
-
memory/3660-185-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3660-190-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/3660-188-0x00000000054C0000-0x000000000555C000-memory.dmpFilesize
624KB
-
memory/3660-189-0x0000000005B10000-0x00000000060B4000-memory.dmpFilesize
5.6MB
-
memory/3660-186-0x000000000040DF0E-mapping.dmp
-
memory/3728-157-0x0000000000000000-mapping.dmp
-
memory/3920-166-0x0000000000000000-mapping.dmp
-
memory/4064-134-0x0000000000000000-mapping.dmp
-
memory/4348-159-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/4348-160-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/4348-153-0x0000000000000000-mapping.dmp
-
memory/4416-146-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/4416-145-0x00007FF984720000-0x00007FF9851E1000-memory.dmpFilesize
10.8MB
-
memory/4416-143-0x0000000000000000-mapping.dmp
-
memory/4460-142-0x0000000000000000-mapping.dmp
-
memory/4664-151-0x0000000000000000-mapping.dmp