Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 20:23

General

  • Target

    fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe

  • Size

    1.6MB

  • MD5

    fcfc0891e383dd78bea0b738b2771643

  • SHA1

    2d6e58beac2275d8f23d5cdcec08af3b82123376

  • SHA256

    c6af10736db72c425555f5e62b2b954fceb9d541aa8dd593bb0f1ca91c9a9b52

  • SHA512

    6c617c3c519580ca79841139ba85864d0a8339251cf8b75654effc71dbbc2ac42be76df8fe809ff8f52a65254495b6a69f157b7a5029192c53d034973e89dbcc

  • SSDEEP

    49152:ch+ZkldoPKi2a9D5SOgTjjhKQVHoF/uY:N2cPKi15SThPVIF

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

soft

C2

googlyoutuob.ddns.net:1177

Mutex

5e9d00b3a9bfb0f9311b1d29c32b918a

Attributes
  • reg_key

    5e9d00b3a9bfb0f9311b1d29c32b918a

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:440
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffae36946f8,0x7ffae3694708,0x7ffae3694718
            5⤵
              PID:1232
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
              5⤵
                PID:3972
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2164
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
                5⤵
                  PID:3044
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
                  5⤵
                    PID:4292
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                    5⤵
                      PID:1588
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
                      5⤵
                        PID:772
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
                        5⤵
                          PID:3228
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1060
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                          5⤵
                            PID:1700
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                            5⤵
                              PID:3172
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                              5⤵
                                PID:2528
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
                                5⤵
                                  PID:1988
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                                  5⤵
                                    PID:4680
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                    5⤵
                                      PID:5004
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,6872066525786753332,754094573120381124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3948 /prefetch:2
                                      5⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:816
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fcfc0891e383dd78bea0b738b2771643_JaffaCakes118.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
                                    4⤵
                                      PID:4640
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae36946f8,0x7ffae3694708,0x7ffae3694718
                                        5⤵
                                          PID:2880
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4740
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3948

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                      SHA1

                                      010da169e15457c25bd80ef02d76a940c1210301

                                      SHA256

                                      6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                      SHA512

                                      e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      85ba073d7015b6ce7da19235a275f6da

                                      SHA1

                                      a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                      SHA256

                                      5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                      SHA512

                                      eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      264B

                                      MD5

                                      24990d0989a4f67fcba228deaaa0a3a0

                                      SHA1

                                      7c2440db2b37401ea4ba760b37aee0632ff7fa3b

                                      SHA256

                                      f6b01f8db225ea2647846815721931f13172e210a2de9d083738e62460ef0779

                                      SHA512

                                      43e0d81881f81d449783a14464bcac3469d49ad68e2be2415b9826718feae4f491c48a69177560e5b17284de2c8f67fc10cc9a3ec8acebb85db24c82df6a3710

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      437B

                                      MD5

                                      05592d6b429a6209d372dba7629ce97c

                                      SHA1

                                      b4d45e956e3ec9651d4e1e045b887c7ccbdde326

                                      SHA256

                                      3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

                                      SHA512

                                      caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      8ef211a175c0ba188b343737586af372

                                      SHA1

                                      c95adfe351caca4c0b5115c341e26eb427bc67a0

                                      SHA256

                                      8d3c6e3a9634089d83b32d00da7eab96e1240ed76a146e10a9663d4b6c4bb0f6

                                      SHA512

                                      5759a6b3dce979d69e1684432d7baa3833c016f61d8e7094f76de65d755a7737f4b8972c6a9ba6e94b22a37018009699610532dbe7ba6de11fa36b1776e89250

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      c33d9b24a8d35386f9b5a420c47095b9

                                      SHA1

                                      ed3be3ef94d0b8b5002758e4322c8420c4bf56a9

                                      SHA256

                                      2bd402ab81b87e2c50224a3ae71699adb8186a3f90c6697b52fc22b6b68e8e7c

                                      SHA512

                                      08dc6f86184355f8ebfc02107a2906eac9b72e37a30c852426ac94f61c113ffbc9cdde7aa2fe39bc73c08f51358c863d48cd2d7f92dffb481d3f56dc5fc867cb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      a368673fe7c9b2f18bbf01d954624295

                                      SHA1

                                      a9fc528b6d1baa063766d7a6fa11c3d0ac8cd0d5

                                      SHA256

                                      6837f2b9171b17d03cb3b35ce24f48a40a3eb0c931ed0837ee0d5d8b7a373185

                                      SHA512

                                      14d80c2dc2863e532a9b33769036511cb96803e1224ebefcc64ab96cee97dec762e41b6f8b969a4d21fc10a4f26e707e3917d6e1129aea97e8dfd9849408c6d2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      371B

                                      MD5

                                      1f2c925f69a8b6b1cbed7035f8952f9d

                                      SHA1

                                      ccdc6efb19927102418d4f200b9962aa356b1bbf

                                      SHA256

                                      0059e7b16272f1bdefe25b71a5d3f5c7624c128803ca8c044190137a3ec21de5

                                      SHA512

                                      fc4568458d33fa6820bab7efbdb01dd79c4d968f32b0173949b82e33ba21a39df879147799d4fe73fa23cd06f7ee2b4aef1f28afa233612c49ddc3e664f2f26d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582ca9.TMP

                                      Filesize

                                      371B

                                      MD5

                                      94585808265ad873ac6b92c957974c50

                                      SHA1

                                      469fec1cc80f35c9834b8cbe72cd29cf0f79e653

                                      SHA256

                                      535887839cf44d2cc8c28a824620c71f4585cecf323b152faac364bb1d97f192

                                      SHA512

                                      c51ff3ebdd6ba026d97d5374d59461eae6074bf82519ae066e0e359f934414bb6eadd5d82c90d46c2797dd358c6b6463105885d00658b0e99c9631a043b9c5e0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      10864f84e938cdad6ada3648ead591d1

                                      SHA1

                                      aa503d919dfcb716c8957281ca1ab99d89fb0c68

                                      SHA256

                                      cd9891fd1e06c26e48d9092db73798f0223dd2e9d890844ffe37c54fb30ecdc7

                                      SHA512

                                      bd162079f01a232e8887b6d35e35bc191c13c956d22790368960592fb4cb3849e5c0b289473e95356c7ddeea9b073fb0db27c261e1d332e4c417ff38b3f005cf

                                    • memory/1748-5-0x0000000000C00000-0x0000000000CE1000-memory.dmp

                                      Filesize

                                      900KB

                                    • memory/1748-1-0x0000000000C00000-0x0000000000CE1000-memory.dmp

                                      Filesize

                                      900KB

                                    • memory/1748-3-0x0000000000C00000-0x0000000000CE1000-memory.dmp

                                      Filesize

                                      900KB

                                    • memory/1748-2-0x0000000000C00000-0x0000000000CE1000-memory.dmp

                                      Filesize

                                      900KB

                                    • memory/1748-0-0x0000000000C00000-0x0000000000CE1000-memory.dmp

                                      Filesize

                                      900KB

                                    • memory/1768-4-0x0000000001430000-0x000000000143C000-memory.dmp

                                      Filesize

                                      48KB