Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-04-2024 14:53
Static task
static1
Behavioral task
behavioral1
Sample
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
ff887fa7815b8759a4908e7db7246dff
-
SHA1
643240f371ba273be5d24d279fa4a12e45d49b19
-
SHA256
34637d766580ee138044aba566756d6ee1356ad1915df4778c72e74dcabd25bb
-
SHA512
3b409a1afd836636a25b93e9a6a8c15d3686b249a05ba60735864cf884f5f9a816e96ee02f411bc31cba5380f1b5e861f5b78c09ceb9c9eddd2a17fe90cf614f
-
SSDEEP
49152:SaMq0SaVfvc8NDRxHjfUlcfkDKG0y4fTOy6XWa:RWa
Malware Config
Extracted
bitrat
1.38
vslt.info:1972
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/4176-9-0x00000000015D0000-0x000000000163E000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-10-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-11-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-13-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-15-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-17-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-19-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-21-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-23-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-25-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-27-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-29-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-31-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-33-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-35-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-37-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-39-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-41-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-43-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-45-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-47-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-49-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-51-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-53-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-55-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-57-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-59-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-61-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-63-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-65-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-67-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-69-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-71-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 behavioral2/memory/4176-73-0x00000000015D0000-0x0000000001637000-memory.dmp family_zgrat_v1 -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\firefox.exe\"," ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation WScript.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exepid process 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exedescription pid process target process PID 4176 set thread context of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exepowershell.exepid process 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 2960 powershell.exe 2960 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exepowershell.exeff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe Token: SeDebugPrivilege 2960 powershell.exe Token: SeShutdownPrivilege 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exepid process 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe 1512 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exeWScript.exedescription pid process target process PID 4176 wrote to memory of 3328 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe WScript.exe PID 4176 wrote to memory of 3328 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe WScript.exe PID 4176 wrote to memory of 3328 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe WScript.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 4176 wrote to memory of 1512 4176 ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe PID 3328 wrote to memory of 2960 3328 WScript.exe powershell.exe PID 3328 wrote to memory of 2960 3328 WScript.exe powershell.exe PID 3328 wrote to memory of 2960 3328 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Xpuqxffprcsiiwrkqgzqm.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\Mozilla\firefox.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ff887fa7815b8759a4908e7db7246dff_JaffaCakes118.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_Xpuqxffprcsiiwrkqgzqm.vbsFilesize
143B
MD5717b4d7fa76feeacd5d14ef6464b138f
SHA1733c2c9e7e6c454621a7de00364f7cf7d4db733e
SHA256fdd3b1fb8750a69b824106dbf0377b7821551544e79fe598283bf58099008c36
SHA5121554a595f894851df685d92af079197c1df730c78505d095e1cfe61ed003b5a009f4335a95165052d7c107f6f76073d876595d78e48fc80892d761c5169dfef0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_keipy2ah.djx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1512-2009-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1512-2029-0x0000000075370000-0x00000000753A9000-memory.dmpFilesize
228KB
-
memory/1512-2026-0x0000000075370000-0x00000000753A9000-memory.dmpFilesize
228KB
-
memory/1512-2023-0x0000000075370000-0x00000000753A9000-memory.dmpFilesize
228KB
-
memory/1512-2020-0x0000000075370000-0x00000000753A9000-memory.dmpFilesize
228KB
-
memory/1512-1953-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/1512-1976-0x0000000070530000-0x0000000070569000-memory.dmpFilesize
228KB
-
memory/1512-1984-0x0000000070490000-0x00000000704C9000-memory.dmpFilesize
228KB
-
memory/1512-2002-0x0000000070100000-0x0000000070139000-memory.dmpFilesize
228KB
-
memory/2960-2010-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/2960-2013-0x0000000007BC0000-0x0000000007BC8000-memory.dmpFilesize
32KB
-
memory/2960-2007-0x0000000007AA0000-0x0000000007AB1000-memory.dmpFilesize
68KB
-
memory/2960-2006-0x0000000007B20000-0x0000000007BB6000-memory.dmpFilesize
600KB
-
memory/2960-2005-0x0000000007910000-0x000000000791A000-memory.dmpFilesize
40KB
-
memory/2960-2004-0x00000000078A0000-0x00000000078BA000-memory.dmpFilesize
104KB
-
memory/2960-2003-0x0000000007F00000-0x000000000857A000-memory.dmpFilesize
6.5MB
-
memory/2960-2011-0x0000000007AE0000-0x0000000007AF4000-memory.dmpFilesize
80KB
-
memory/2960-1999-0x0000000007790000-0x0000000007833000-memory.dmpFilesize
652KB
-
memory/2960-1998-0x0000000006B00000-0x0000000006B1E000-memory.dmpFilesize
120KB
-
memory/2960-1988-0x0000000070970000-0x00000000709BC000-memory.dmpFilesize
304KB
-
memory/2960-1987-0x0000000006B20000-0x0000000006B52000-memory.dmpFilesize
200KB
-
memory/2960-1986-0x000000007F5E0000-0x000000007F5F0000-memory.dmpFilesize
64KB
-
memory/2960-1985-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2960-2012-0x0000000007BE0000-0x0000000007BFA000-memory.dmpFilesize
104KB
-
memory/2960-2008-0x0000000007AD0000-0x0000000007ADE000-memory.dmpFilesize
56KB
-
memory/2960-1974-0x00000000065C0000-0x000000000660C000-memory.dmpFilesize
304KB
-
memory/2960-1973-0x0000000006570000-0x000000000658E000-memory.dmpFilesize
120KB
-
memory/2960-1972-0x0000000005FB0000-0x0000000006304000-memory.dmpFilesize
3.3MB
-
memory/2960-2014-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2960-1962-0x0000000005F40000-0x0000000005FA6000-memory.dmpFilesize
408KB
-
memory/2960-1961-0x0000000005E20000-0x0000000005E86000-memory.dmpFilesize
408KB
-
memory/2960-1960-0x00000000055A0000-0x00000000055C2000-memory.dmpFilesize
136KB
-
memory/2960-1959-0x0000000005640000-0x0000000005C68000-memory.dmpFilesize
6.2MB
-
memory/2960-1958-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2960-1957-0x0000000004FC0000-0x0000000004FD0000-memory.dmpFilesize
64KB
-
memory/2960-1956-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/2960-1955-0x0000000004FD0000-0x0000000005006000-memory.dmpFilesize
216KB
-
memory/2960-2017-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4176-31-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-35-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-73-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-69-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-67-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-1954-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4176-65-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-63-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-61-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-59-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-57-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-55-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-53-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-51-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-49-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-47-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-45-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-43-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-41-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-39-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-37-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-71-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-33-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-0-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4176-29-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-27-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-25-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-23-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-21-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-19-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-17-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-15-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-13-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-11-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-10-0x00000000015D0000-0x0000000001637000-memory.dmpFilesize
412KB
-
memory/4176-9-0x00000000015D0000-0x000000000163E000-memory.dmpFilesize
440KB
-
memory/4176-8-0x0000000006D30000-0x0000000006F3C000-memory.dmpFilesize
2.0MB
-
memory/4176-7-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4176-6-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4176-5-0x00000000056A0000-0x00000000056AA000-memory.dmpFilesize
40KB
-
memory/4176-4-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/4176-3-0x0000000005600000-0x0000000005692000-memory.dmpFilesize
584KB
-
memory/4176-2-0x0000000005D00000-0x00000000062A4000-memory.dmpFilesize
5.6MB
-
memory/4176-1-0x0000000000960000-0x0000000000C44000-memory.dmpFilesize
2.9MB