Analysis Overview
SHA256
b404540c08dba99d1333ecfab6fb916a0126a724aef13cf52b7412688cfd5c88
Threat Level: Known bad
The file JaffaCakes118_26533c44acef93adedc8e0c43b4a9165 was found to be: Known bad.
Malicious Activity Summary
LatentBot
Latentbot family
Darkcomet
Darkcomet family
Executes dropped EXE
Checks computer location settings
Unsigned PE
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-02-26 13:38
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-02-26 13:38
Reported
2025-02-26 13:41
Platform
win7-20241010-en
Max time kernel
149s
Max time network
120s
Command Line
Signatures
Darkcomet
Darkcomet family
LatentBot
Latentbot family
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26533c44acef93adedc8e0c43b4a9165.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26533c44acef93adedc8e0c43b4a9165.exe"
C:\Users\Admin\AppData\Local\Temp\testestset.exe
"C:\Users\Admin\AppData\Local\Temp\testestset.exe"
C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe"
C:\Program Files\Java\jre7\bin\java.exe
"C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\Admin\AppData\Roaming\.techniclauncher\technic-launcher.jar
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 206.217.207.1:80 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 206.217.207.1:80 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 206.217.207.1:80 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| N/A | 127.0.0.1:1604 | tcp |
Files
memory/2956-0-0x000007FEF56FE000-0x000007FEF56FF000-memory.dmp
memory/2956-4-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp
memory/2956-2-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\testestset.exe
| MD5 | e007637a3484b083e394fb91085324f1 |
| SHA1 | c5a98f51a5174b5afa7d6c9ed518d77135891902 |
| SHA256 | 8abb0fddd1c5db8de5dd09c67166a339100b4bd6f2a72a52b0187d53b0fc84e9 |
| SHA512 | 442c75044670e16dccacb55f5c736b4a87b21cefd62a361bd9530fed440abb1c9f93f499bbb038b9233f725b1e69a3068f8d8b6af6ec80168fe448ccb81095c6 |
C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe
| MD5 | d6baeadad8c792724aeda91d619a4774 |
| SHA1 | 997e1abb97918f9f0e66e642bbb499799f625df7 |
| SHA256 | d9b10efeba3336e15e12904cd4e22aa8dec27f11a19503c8e8725b1a61cde680 |
| SHA512 | a0b1df78d9198af04707ffd14263d99002fc5ee77c18bc79e6078fa3be1c3d7cc7b4450802643cae34a003cefe73a6b94d51aabf9f33a77b9ad87c0c71590293 |
memory/2864-16-0x0000000001F60000-0x0000000001FE0000-memory.dmp
memory/2224-15-0x0000000000650000-0x0000000000651000-memory.dmp
memory/2956-17-0x000007FEF5440000-0x000007FEF5DDD000-memory.dmp
memory/2224-18-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2864-19-0x0000000001F60000-0x0000000001FE0000-memory.dmp
memory/2224-20-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-21-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-22-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-23-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-24-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-25-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-26-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-27-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-28-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-29-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-30-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-31-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/2224-32-0x0000000000400000-0x00000000004B7000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-02-26 13:38
Reported
2025-02-26 13:41
Platform
win10v2004-20250217-en
Max time kernel
150s
Max time network
151s
Command Line
Signatures
Darkcomet
Darkcomet family
LatentBot
Latentbot family
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26533c44acef93adedc8e0c43b4a9165.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\testestset.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26533c44acef93adedc8e0c43b4a9165.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_26533c44acef93adedc8e0c43b4a9165.exe"
C:\Users\Admin\AppData\Local\Temp\testestset.exe
"C:\Users\Admin\AppData\Local\Temp\testestset.exe"
C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe"
C:\Program Files\Java\jre-1.8\bin\java.exe
"C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Roaming\.techniclauncher\technic-launcher.jar
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| US | 206.217.207.1:80 | tcp | |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 206.217.207.1:80 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 206.217.207.1:80 | tcp | |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | robloxdlex.zapto.org | udp |
| N/A | 127.0.0.1:1604 | tcp | |
| US | 8.8.8.8:53 | attackcraft.zapto.org | udp |
Files
memory/1568-0-0x00007FF967905000-0x00007FF967906000-memory.dmp
memory/1568-1-0x000000001BC40000-0x000000001BCE6000-memory.dmp
memory/1568-2-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/1568-3-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\testestset.exe
| MD5 | e007637a3484b083e394fb91085324f1 |
| SHA1 | c5a98f51a5174b5afa7d6c9ed518d77135891902 |
| SHA256 | 8abb0fddd1c5db8de5dd09c67166a339100b4bd6f2a72a52b0187d53b0fc84e9 |
| SHA512 | 442c75044670e16dccacb55f5c736b4a87b21cefd62a361bd9530fed440abb1c9f93f499bbb038b9233f725b1e69a3068f8d8b6af6ec80168fe448ccb81095c6 |
C:\Users\Admin\AppData\Local\Temp\TechnicLauncher.exe
| MD5 | d6baeadad8c792724aeda91d619a4774 |
| SHA1 | 997e1abb97918f9f0e66e642bbb499799f625df7 |
| SHA256 | d9b10efeba3336e15e12904cd4e22aa8dec27f11a19503c8e8725b1a61cde680 |
| SHA512 | a0b1df78d9198af04707ffd14263d99002fc5ee77c18bc79e6078fa3be1c3d7cc7b4450802643cae34a003cefe73a6b94d51aabf9f33a77b9ad87c0c71590293 |
memory/4164-28-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/1568-27-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/4164-31-0x000000001C5E0000-0x000000001C67C000-memory.dmp
memory/4164-30-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/4164-29-0x000000001C110000-0x000000001C5DE000-memory.dmp
memory/4164-32-0x0000000001500000-0x0000000001508000-memory.dmp
memory/4164-33-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/3260-34-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-35-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-36-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-37-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-38-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-39-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/4164-41-0x00007FF967650000-0x00007FF967FF1000-memory.dmp
memory/3260-42-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-43-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-44-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-45-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-46-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-47-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-48-0x0000000000400000-0x00000000004B7000-memory.dmp
memory/3260-49-0x0000000000400000-0x00000000004B7000-memory.dmp