Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 20:30
Static task
static1
Behavioral task
behavioral1
Sample
goodbye.ps1
Resource
win7-20220901-en
General
-
Target
goodbye.ps1
-
Size
7.7MB
-
MD5
76cb211a39e29bd567554bdf1f2ee63c
-
SHA1
59e4aa84771e257ccc1e1e1db35608aa9bec9fc8
-
SHA256
19ee843d37c1586e9058ff1f09c7e7c27da7ae568d44e1c95387b3f851d0c3eb
-
SHA512
eb0f3858c63c8448ef17bdd8b385cda7596394d6d3a3f0c128a894ce7664fdd45e5a0b83b93ee6557bc78a1f05ae38a4910beb9c61e7f57ce8e84a294470d5f8
-
SSDEEP
24576:cfn0m/OPb9o/Ha4KZZQLFq487s/0H+VXQ5qDrtj6Bnoi4LD2/Qy4IyQr+KJn04vd:x
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
worldpassed.publicvm.com:199
AsyncMutex_6SI8OkBrC
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe -
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1144-173-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/1144-174-0x000000000040DF0E-mapping.dmp asyncrat -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.execmd.exeWScript.exemshta.exeWScript.exeWScript.exeWScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 840 set thread context of 1144 840 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4124 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
powershell.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 5072 powershell.exe 5072 powershell.exe 3820 powershell.exe 3820 powershell.exe 1080 powershell.exe 1080 powershell.exe 1244 powershell.exe 1244 powershell.exe 840 powershell.exe 840 powershell.exe 1900 powershell.exe 1900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exepowershell.exetaskkill.exepowershell.exepowershell.exepowershell.exeaspnet_compiler.exepowershell.exedescription pid process Token: SeDebugPrivilege 5072 powershell.exe Token: SeDebugPrivilege 3820 powershell.exe Token: SeDebugPrivilege 4124 taskkill.exe Token: SeDebugPrivilege 1080 powershell.exe Token: SeDebugPrivilege 1244 powershell.exe Token: SeDebugPrivilege 840 powershell.exe Token: SeDebugPrivilege 1144 aspnet_compiler.exe Token: SeDebugPrivilege 1900 powershell.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
powershell.exeWScript.execmd.exepowershell.exemshta.execmd.exeWScript.exemshta.execmd.exeWScript.exeWScript.exepowershell.exeWScript.exedescription pid process target process PID 5072 wrote to memory of 2412 5072 powershell.exe WScript.exe PID 5072 wrote to memory of 2412 5072 powershell.exe WScript.exe PID 5072 wrote to memory of 1892 5072 powershell.exe schtasks.exe PID 5072 wrote to memory of 1892 5072 powershell.exe schtasks.exe PID 2412 wrote to memory of 3532 2412 WScript.exe cmd.exe PID 2412 wrote to memory of 3532 2412 WScript.exe cmd.exe PID 3532 wrote to memory of 3820 3532 cmd.exe powershell.exe PID 3532 wrote to memory of 3820 3532 cmd.exe powershell.exe PID 3820 wrote to memory of 5028 3820 powershell.exe cmstp.exe PID 3820 wrote to memory of 5028 3820 powershell.exe cmstp.exe PID 3260 wrote to memory of 1072 3260 mshta.exe cmd.exe PID 3260 wrote to memory of 1072 3260 mshta.exe cmd.exe PID 1072 wrote to memory of 3576 1072 cmd.exe WScript.exe PID 1072 wrote to memory of 3576 1072 cmd.exe WScript.exe PID 3576 wrote to memory of 3840 3576 WScript.exe cmd.exe PID 3576 wrote to memory of 3840 3576 WScript.exe cmd.exe PID 1684 wrote to memory of 4124 1684 mshta.exe taskkill.exe PID 1684 wrote to memory of 4124 1684 mshta.exe taskkill.exe PID 3840 wrote to memory of 1080 3840 cmd.exe powershell.exe PID 3840 wrote to memory of 1080 3840 cmd.exe powershell.exe PID 3004 wrote to memory of 1244 3004 WScript.exe powershell.exe PID 3004 wrote to memory of 1244 3004 WScript.exe powershell.exe PID 4532 wrote to memory of 840 4532 WScript.exe powershell.exe PID 4532 wrote to memory of 840 4532 WScript.exe powershell.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 840 wrote to memory of 1144 840 powershell.exe aspnet_compiler.exe PID 1072 wrote to memory of 1900 1072 WScript.exe powershell.exe PID 1072 wrote to memory of 1900 1072 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\goodbye.ps11⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\a.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\a.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\b.ps14⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmstp.exe"C:\Windows\system32\cmstp.exe" /au C:\Windows\temp\gix0nvuv.inf5⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn administartor /sc minute /st 00:10 /tr C:\Users\Admin\Favorites\System.vbs2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""cmd.exe /c start """""""" """"%USERPROFILE%\Favorites\Assembly.vbs"""""",0:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\Favorites\Assembly.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Favorites\Assembly.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Favorites\x.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -NoProfile -ExecutionPolicy Bypass -Command C:\Users\Admin\Favorites\x.ps15⤵
- UAC bypass
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""taskkill /IM cmstp.exe /F"", 0, true:close")1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /IM cmstp.exe /F2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WScript.exeC:\Windows\System32\WScript.exe "C:\Users\Admin\Favorites\System.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & C:\Users\Admin\Favorites\micro.ps12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD595e1c8db6eb5be60fa7c5f7ca36bfaed
SHA15b23544fe29ddd6f07852b4ff8971a5bf6c0fdf9
SHA2563b3202f973ef9c0f477b91a022fd535a21e8b444279d8be34fcd16fccfe68a18
SHA512de221bd9c8728434d7a463d7bc5123c5bc45362224b8e312abef60e2e89197cd9b77839df07069d663a483233d3395e9cd8b414d68c3b857eb9171d6d8a195db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD5447c9173cd8eb4031db128b10a6ed274
SHA117fb39c16feb1f6c682a1b71b8734636b52e27e0
SHA256440ae83a949c4dcbee32fb29d4a8e5425f94e5fce714c4c9b9b14948cf6d0e57
SHA5128579867c4f39761b216882c0be09f8cef187e36033e44e74e87266f090d861ad0e8cb7bae321c966d2ede9b9195da7d49f000ae8e1c67ab70aa4e5a08500ec19
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD557866c0b343808442b8657c28107e5cd
SHA1b131d901e867ca5a3de95ca3fc12b5a483137e31
SHA256232e6e16bb2f27daa78c8f60a34e6b2da4314cc004487c0b5b8ed0563d82fb73
SHA51245b9cb4901b36bb32ac1807a43f91b6e023a88ac3f92091051a0162bc275d21b850d6861f15caae188a8ac5c8d3fd9ef8cd8925afb230f4588208b1e449b59cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD58655b0366179d8ce082c1a7074e13481
SHA14d1ae8da6a4d1a7d0c515d3d7e671634b2d8b8de
SHA256949304506fef7ab625fa806eba571e5a04a08e7e00d999cd3e1e6a5920fc1a2f
SHA51223c1ec30c806c58bd66ecf87de9eeae403646a4aa8447daa8508132cf43d1796bbc11bd1b3bf38352f11c7c9b0a2abd756a0d6589489a545e919919595a15c5f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5f0fa428951a2534907cb5743cd3aa47b
SHA16bb7583f0446bd5b37ab4089ace28eada2ee2558
SHA25646b5a511f0a4f4b545ecf94e1623e520a46f792caf99edfa78cb48103e9bcb5c
SHA512a14ee584c57bb7352fdf4217c41918e457a32a3244329ccd6fd760bc2e5b1c4ef86916777d2bed62610e1cd546cabaa76e69cfe01acded413478abb5d554119d
-
C:\Users\Admin\Favorites\Assembly.vbsFilesize
331B
MD566d268811c166c82aaef2f52450b0c73
SHA1f7810c1003732c440b986718a8217dd733e88f74
SHA256581df8170200c95d38ce78eba4e9942d47cad443bbc0148954e48df04eec3b34
SHA51236de3a5f59ee7a531832ae7e43997a3019ad8a15b0d1b321e589a85d77af27dab80b90a0ef5c978c4fffcc4d32fe8d870f60e9cf3e5bff302e4292bfc6196830
-
C:\Users\Admin\Favorites\System.vbsFilesize
121B
MD5dada8407cf4051919362d16a6d735cde
SHA18a2788926f97dbd59c99ad51b3383c59992c6c2e
SHA256ee512a4266049b505b2b5c6c4c7bd66baadd37eda61bfe7f31f6cfcc1c955a77
SHA51242c6b1fac8502e3b21cbd6cda11601afc55ca539db03667eec7c839bc33c70ed1a6aeba5a3c9684951143658b17183c2782bec8a0108b345c0ac2aebdaa8fc9f
-
C:\Users\Admin\Favorites\UAC-B.dllFilesize
11KB
MD5cc6ba6fc273dbfbb5c9698c0cf4719b9
SHA1a2b3433b728b0874ec69d8a629d5f0dd05c0946d
SHA256320316cdda2aa0e8709472a2b8eb8debcd0f8bb6f9af4d4d4b3bc67068ceebe7
SHA512fe2fe2f150fbf619dd7616c86c93a42446b7c915b92fb865971dcf7dd595c6483da7386ce40b99802dc0942068bd1703821e0e3b15a6ebe557619cf6fa413c61
-
C:\Users\Admin\Favorites\a.batFilesize
86B
MD54625a049cd6ea721b706699ab3c36dff
SHA1dbb82c9e8cb7bdcf617e7c4e158d031275b5ec24
SHA256c751a3cb67ab1c75f1de6e24b7193123cc815524c538973110d1f6027da24dc0
SHA51235674c3c1d6c449b3716ddf2ca8733e255a8f642723186a847694fb936b50a91e6bd7ab7f6edf1489592a583109739a4f0c12769823e2fc163860eeb7004b6c0
-
C:\Users\Admin\Favorites\a.vbsFilesize
485B
MD55ce49e20c572f2b6d4b43fc61a6906ec
SHA1170185b8ab9fc4749f28e5796999c23b50be89dc
SHA256d6a43aad0aa8e510f01409921c8b0b5c8d93d51d1f7f39340db775c164686412
SHA512c49e14c094e4d5e108aa50889a9fb06428a3d7a1f74d868c9b7d37f35658a64ea205b00681ad83aef428113fdf6fead8ef98dd1e6b38d84b8306765025c2e8e3
-
C:\Users\Admin\Favorites\b.ps1Filesize
173B
MD5e1d9cbc41ffacef02695df17824a82e0
SHA1970ae087b8a3d11fb3e2a9b8de1592a166436fa7
SHA25661571d1fd0000c02eef19b7dd6e452e2f9eba2e947f4c96d781e79d35802043f
SHA5123b4034b2072a309adeb1af8b540023791262915f4b1347f4aa27f8aedcbbb6e1126c1a4d5f1db1ce2ad5638d24d7ba3025a8451c291241db2f2a99b0832f620a
-
C:\Users\Admin\Favorites\micro.ps1Filesize
888KB
MD52c012c85dad2ed3845d3606fb4204d9d
SHA1aae41574a6a9fe13b8552a3aba61bc5a550d4161
SHA256ad4059af90d7d3a2690eef17d4fe45cc1d6b5b8c0ae806bc0d598e5a4838cd84
SHA5127d9da6e1f243a2bd55b7ce91d2657077268612cc176bc279e79fabedcd7cde740534d46289371759532e31676f62f76af602780f4f728437bc8344e62799873d
-
C:\Users\Admin\Favorites\micro.ps1Filesize
444KB
MD56c7473033862bc8f2d1ca5d2f64593a8
SHA1420a0f9508cf7a6e17ecb7670a9df7cbbb8c24d7
SHA25672842be7f7e16ffbb22c2646b18aa647537742782c2df530ad5076890743ea0e
SHA5122a9eda8fec9f0684bb2a8016868150a660181dabdfb29eec7a942ee4f843c63a854c42aaab2395e418dbb35be11134ec4ff5014e2daa4210bd891238d759f2f2
-
C:\Users\Admin\Favorites\x.batFilesize
86B
MD503fc58bceab448c9f183fbe86fed1f11
SHA107f3d54b0b40755e8f58f5fdab95049def6578e3
SHA2566062f0e764ccd855b61ba49720065dfd6f6c6864c4eb1e9dce95ba8a293fd756
SHA512c0e9aec7a6c5aaae3b018d44f1fbdc1939026ce16fad20211a0521e3db9e470d842508b7d2167672e1585bafeb4b2f1fe694ca96ddb9137ff9e5d3b4ca53ea4f
-
C:\Users\Admin\Favorites\x.ps1Filesize
567B
MD5e9859d3134c68db3134a6ca7df484344
SHA1f4eec5ee9aa11a82d19bdb78a174c574669fd1d8
SHA256a4aaf6c64969788732b20c79c1299719b84a52eddda13778a672195bbfba4a6c
SHA51247982ddf074418c350790f5f7d53edddbbb47e7768939ebf88f4812b01f241c8bff509dbd9a8e6232eb6ec7f8b0344a1a59474ea45da0c80af9f04ba21498cdb
-
C:\Windows\temp\gix0nvuv.infFilesize
834B
MD509c0056318d62ee84963c66ae83d6c1b
SHA1625936963d4a0059daff7222a1628198be9b7a4f
SHA25625b2a55bade39fe6d90e0fb06068062a95af522f62d743454ffa4ddd478781d8
SHA512b03301fcafbc905ac7724b5ee878208c4c7dc039b02edcfc00e51742c868ab4cf3f830dbbe52b314ee24f8d87f39b6c9eb3e6c188ddc75a9b52f7dfab85cb2d0
-
memory/840-175-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/840-172-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/840-169-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/840-168-0x0000000000000000-mapping.dmp
-
memory/1072-150-0x0000000000000000-mapping.dmp
-
memory/1080-163-0x00007FFB8CE00000-0x00007FFB8D8C1000-memory.dmpFilesize
10.8MB
-
memory/1080-157-0x0000000000000000-mapping.dmp
-
memory/1080-158-0x00007FFB8CE00000-0x00007FFB8D8C1000-memory.dmpFilesize
10.8MB
-
memory/1144-173-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1144-174-0x000000000040DF0E-mapping.dmp
-
memory/1144-178-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/1144-177-0x0000000006300000-0x00000000068A4000-memory.dmpFilesize
5.6MB
-
memory/1144-176-0x0000000005CB0000-0x0000000005D4C000-memory.dmpFilesize
624KB
-
memory/1244-162-0x0000000000000000-mapping.dmp
-
memory/1244-166-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/1244-167-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/1892-135-0x0000000000000000-mapping.dmp
-
memory/1900-182-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/1900-180-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/1900-179-0x0000000000000000-mapping.dmp
-
memory/2412-134-0x0000000000000000-mapping.dmp
-
memory/3532-139-0x0000000000000000-mapping.dmp
-
memory/3576-152-0x0000000000000000-mapping.dmp
-
memory/3820-140-0x0000000000000000-mapping.dmp
-
memory/3820-145-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/3820-148-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/3840-155-0x0000000000000000-mapping.dmp
-
memory/4124-156-0x0000000000000000-mapping.dmp
-
memory/5028-146-0x0000000000000000-mapping.dmp
-
memory/5072-132-0x000001624B530000-0x000001624B552000-memory.dmpFilesize
136KB
-
memory/5072-137-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB
-
memory/5072-133-0x00007FFB8E480000-0x00007FFB8EF41000-memory.dmpFilesize
10.8MB