Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 20:40

General

  • Target

    e33e3d1648bd9a98fc3875c1eb376889_JaffaCakes118.exe

  • Size

    2.3MB

  • MD5

    e33e3d1648bd9a98fc3875c1eb376889

  • SHA1

    b684d4ea15479d2a09448d59d5aa6db5d666b012

  • SHA256

    8be67974b71de6b2a70585cf81fe0d6a5cf67e9c03a667834e4a177e210ab500

  • SHA512

    0948ffad6846adcf67700430d6dea1370f7948fa65fe3a17e391b4f2f49ce5cf262fec5226011d2951268142c3ee4f60ceb8d050052ed0a6f10e042d7cbb6153

  • SSDEEP

    49152:A+mKqRWCKBA8N/7dtgQxmapsprT03R/zu7uEI:A7ReBxNLgkXp6w5zEuV

Score
10/10

Malware Config

Signatures

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 16 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e33e3d1648bd9a98fc3875c1eb376889_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e33e3d1648bd9a98fc3875c1eb376889_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Users\Admin\AppData\Roaming\etc.exe
      C:\Users\Admin\AppData\Roaming\etc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Windows\system32\cmd.exe
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2580
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2436
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1700
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2616
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Roaming\etc.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
          C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Roaming\etc.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1216
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
              6⤵
              • Creates scheduled task(s)
              PID:2100
          • C:\Windows\system32\services32.exe
            "C:\Windows\system32\services32.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2244
            • C:\Windows\system32\cmd.exe
              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:376
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:788
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1996
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2136
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1652
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
              6⤵
              • Loads dropped DLL
              PID:1292
              • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1780
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
                  8⤵
                    PID:1320
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
                      9⤵
                      • Creates scheduled task(s)
                      PID:2524
                  • C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
                    "C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
                    8⤵
                    • Executes dropped EXE
                    PID:1688
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                    8⤵
                      PID:2276
                      • C:\Windows\system32\choice.exe
                        choice /C Y /N /D Y /T 3
                        9⤵
                          PID:3028
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2820
                  • C:\Windows\system32\choice.exe
                    choice /C Y /N /D Y /T 3
                    6⤵
                      PID:2824
            • C:\Users\Admin\AppData\Roaming\build.exe
              C:\Users\Admin\AppData\Roaming\build.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2788

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                  Filesize

                  68KB

                  MD5

                  29f65ba8e88c063813cc50a4ea544e93

                  SHA1

                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                  SHA256

                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                  SHA512

                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                  Filesize

                  344B

                  MD5

                  d247a95b20d72f12cec988c9aeb3236f

                  SHA1

                  c0ee14281492a65178294991fbd2f8abef48d0a6

                  SHA256

                  a8d549c14714305b39e8f804147baf672a97111867e6acd151edde5afee980d2

                  SHA512

                  cd4108c7bf72841535eec221a9a122077dbfafd0e5acb38c6679b8cfe9048d9312aef589f367cc5d548276d7055061c0a630db3ea94058047069fe6653348c81

                • C:\Users\Admin\AppData\Local\Temp\TarA6B2.tmp

                  Filesize

                  177KB

                  MD5

                  435a9ac180383f9fa094131b173a2f7b

                  SHA1

                  76944ea657a9db94f9a4bef38f88c46ed4166983

                  SHA256

                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                  SHA512

                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                • C:\Users\Admin\AppData\Local\Temp\svchost32.exe

                  Filesize

                  134KB

                  MD5

                  c0a0f69a8f0bd1078e29a87b690b1dd5

                  SHA1

                  188e719ae4fb1a14f5cc41957c6b399ce63f4bae

                  SHA256

                  2e95db0ce8987a00938465dfa31e470a70d01a44243b4dbfa843ba7072f23312

                  SHA512

                  8b37d2c80d2ccdbcf8644b5e816b106de2715b30e0832c22790868ce8c03b0548828898436789743f73250d0a9f4df5da1dc364b0abef5ca8bd4402f87e09020

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  436bbc2cffd05b2a4046e620e19d4fd0

                  SHA1

                  7d5ac9ec077ae0fb61226ab8bb9b93194aaad539

                  SHA256

                  bedc627b34ac4c81af3148dd92c1245702d27e8966d2473b5635fdede8895b1e

                  SHA512

                  3746d3b0778c197f66e5916e6b8877b956ea22246e58d144c8860dbcb607f5c72e7bd9844464ea3fa8701fcd35697ce54004269d75cd948660fefecba1c809a6

                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                  Filesize

                  7KB

                  MD5

                  f2643ab8f9ea5faf8adc0348c152b598

                  SHA1

                  88764c03b9f7f94bfab24c4a216f6ba92b8bc66d

                  SHA256

                  20560f99229b090a82e52618cd95bdc12ddc56badedb5afb8e7a6086ce11fc60

                  SHA512

                  f12626c3c4a586b1b3e3282e0cad1fe477b6719bd084ec19202385966d4760a62200e76186b7542051e3eb56c9ec19e814e01a6169857789da538871d49ae700

                • C:\Users\Admin\AppData\Roaming\etc.exe

                  Filesize

                  272KB

                  MD5

                  5faf6449781d220959da0baf48d46f74

                  SHA1

                  ca583a6bcf391458da10cf4a57353a4c986c5883

                  SHA256

                  a61f251f1d025884d666a845710b903b566d3f2abc5a64509eba474b0101a672

                  SHA512

                  98d4e333263d56bc0fda0c255c0ac61ac53df954c7c8511e0bf9611a0b9a82913e530b29e380d823e7ea522ae8626b8e10b79cb47e49fb82d138745bbcc9e379

                • \Users\Admin\AppData\Roaming\build.exe

                  Filesize

                  2.0MB

                  MD5

                  40ad1426ea2983757438d993fd878437

                  SHA1

                  2ebc872bb918fae9b54f8dc53468faf87c4a2e7e

                  SHA256

                  83322d1873b5690241c4b3d29102d577ccf65d4307141d11a5300a16a38484e2

                  SHA512

                  7bc43d65315c1c1b18a9b05b33a760478adda7a8eada0043931ebc0198ec35a396395f2ed4dafae5df0c9ece02b4b9b3b92c3a42876c98c04deec8c0646ee646

                • \Windows\System32\Microsoft\Telemetry\sihost32.exe

                  Filesize

                  59KB

                  MD5

                  05338b92b386f4757a399835b5807a28

                  SHA1

                  9d20f6c20d441b6848adaab170e27d1e317032e2

                  SHA256

                  f9c2c1db5dedb4aa64002541a824d44e51469091f5f9d7a9da46bee35f2d8a6d

                  SHA512

                  ea1c186c646f734e3f82e2921e50e34c4a8b1036e5fcc01d74f601930f7b09c7416bdc3bfc57d9b21295b1b1fad3ecef1216ff3b25f3fa43d9167c17131afc0f

                • memory/788-103-0x00000000028E0000-0x0000000002960000-memory.dmp

                  Filesize

                  512KB

                • memory/788-102-0x00000000028E0000-0x0000000002960000-memory.dmp

                  Filesize

                  512KB

                • memory/788-104-0x00000000028E0000-0x0000000002960000-memory.dmp

                  Filesize

                  512KB

                • memory/788-99-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/788-98-0x000000001B660000-0x000000001B942000-memory.dmp

                  Filesize

                  2.9MB

                • memory/788-100-0x00000000028E0000-0x0000000002960000-memory.dmp

                  Filesize

                  512KB

                • memory/788-101-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/788-105-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1676-81-0x0000000000540000-0x0000000000554000-memory.dmp

                  Filesize

                  80KB

                • memory/1676-78-0x000000013FE20000-0x000000013FE46000-memory.dmp

                  Filesize

                  152KB

                • memory/1676-91-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1676-82-0x000000001AE30000-0x000000001AEB0000-memory.dmp

                  Filesize

                  512KB

                • memory/1676-80-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1700-50-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1700-55-0x0000000002C10000-0x0000000002C90000-memory.dmp

                  Filesize

                  512KB

                • memory/1700-57-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1700-48-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1700-49-0x0000000002C10000-0x0000000002C90000-memory.dmp

                  Filesize

                  512KB

                • memory/1700-51-0x0000000002C10000-0x0000000002C90000-memory.dmp

                  Filesize

                  512KB

                • memory/1700-52-0x0000000002C10000-0x0000000002C90000-memory.dmp

                  Filesize

                  512KB

                • memory/1968-53-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1968-10-0x000000013FAD0000-0x000000013FB1A000-memory.dmp

                  Filesize

                  296KB

                • memory/1968-13-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1968-12-0x0000000000550000-0x0000000000576000-memory.dmp

                  Filesize

                  152KB

                • memory/1968-17-0x000000001BC90000-0x000000001BD10000-memory.dmp

                  Filesize

                  512KB

                • memory/1968-69-0x000000001BC90000-0x000000001BD10000-memory.dmp

                  Filesize

                  512KB

                • memory/1968-79-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1996-113-0x0000000002E00000-0x0000000002E80000-memory.dmp

                  Filesize

                  512KB

                • memory/1996-115-0x0000000002E00000-0x0000000002E80000-memory.dmp

                  Filesize

                  512KB

                • memory/1996-116-0x0000000002E00000-0x0000000002E80000-memory.dmp

                  Filesize

                  512KB

                • memory/1996-111-0x0000000001D20000-0x0000000001D28000-memory.dmp

                  Filesize

                  32KB

                • memory/1996-114-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1996-112-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2244-92-0x00000000024C0000-0x0000000002540000-memory.dmp

                  Filesize

                  512KB

                • memory/2244-89-0x000000013F910000-0x000000013F95A000-memory.dmp

                  Filesize

                  296KB

                • memory/2244-90-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2436-40-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                • memory/2436-42-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2436-35-0x000000001B480000-0x000000001B762000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2436-37-0x0000000002820000-0x0000000002828000-memory.dmp

                  Filesize

                  32KB

                • memory/2436-36-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2436-38-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                • memory/2436-39-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2436-41-0x00000000029B0000-0x0000000002A30000-memory.dmp

                  Filesize

                  512KB

                • memory/2580-26-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2580-25-0x0000000001DE0000-0x0000000001E60000-memory.dmp

                  Filesize

                  512KB

                • memory/2580-22-0x000000001B790000-0x000000001BA72000-memory.dmp

                  Filesize

                  2.9MB

                • memory/2580-23-0x00000000022A0000-0x00000000022A8000-memory.dmp

                  Filesize

                  32KB

                • memory/2580-29-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2580-28-0x0000000001DE0000-0x0000000001E60000-memory.dmp

                  Filesize

                  512KB

                • memory/2580-24-0x000007FEF2AC0000-0x000007FEF345D000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2616-64-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2616-65-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2616-66-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2616-67-0x00000000028A0000-0x0000000002920000-memory.dmp

                  Filesize

                  512KB

                • memory/2616-68-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2616-70-0x000007FEF2120000-0x000007FEF2ABD000-memory.dmp

                  Filesize

                  9.6MB

                • memory/2788-144-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-275-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-27-0x0000000002D80000-0x0000000002DC0000-memory.dmp

                  Filesize

                  256KB

                • memory/2788-71-0x0000000002D80000-0x0000000002DC0000-memory.dmp

                  Filesize

                  256KB

                • memory/2788-56-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-146-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-54-0x00000000744B0000-0x0000000074B9E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2788-16-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

                  Filesize

                  3.8MB

                • memory/2788-15-0x00000000744B0000-0x0000000074B9E000-memory.dmp

                  Filesize

                  6.9MB

                • memory/2788-14-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-274-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-72-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-278-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-279-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-280-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-281-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-282-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-283-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-284-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-285-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB

                • memory/2788-286-0x0000000000FD0000-0x00000000018F8000-memory.dmp

                  Filesize

                  9.2MB