Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
20/01/2024, 01:30
General
- Target 69239f00ab177dd01230afca766ae13e.exe
- Size 166KB
- Sample240120-bxap1ahbfm
- SHA256 c252fa36b3753bb19c034bd3c97b52cfdca0bed6f871ac1c91e5504aecb8154c
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 35 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69239f00ab177dd01230afca766ae13e.exe"C:\Users\Admin\AppData\Local\Temp\69239f00ab177dd01230afca766ae13e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69239f00ab177dd01230afca766ae13e.exe"C:\Users\Admin\AppData\Local\Temp\69239f00ab177dd01230afca766ae13e.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Users\Admin\AppData\Local\Temp\69239F~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Users\Admin\AppData\Local\Temp\69239F~1.EXE4⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE21⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE23⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE25⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE27⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE29⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE31⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE33⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE35⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE37⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE39⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE41⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE43⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE45⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE47⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE48⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE49⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE50⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE51⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE52⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE53⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE54⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE55⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE56⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE57⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE58⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE59⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE60⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE61⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE62⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE63⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE64⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE65⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE66⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE67⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE68⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE69⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE70⤵
- Checks computer location settings
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE71⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\intelgfx32.exe"C:\Windows\system32\intelgfx32.exe" C:\Windows\SysWOW64\INTELG~1.EXE72⤵
- Maps connected drives based on registry
- Drops file in System32 directory
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
intelgfx32.exe
intelgfx32.exe
memory/408-107-0x0000000000400000-0x0000000000466000-memory.dmp
memory/408-109-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1084-248-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1084-245-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1128-125-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1128-129-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1196-229-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1196-224-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1244-71-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1244-73-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1412-324-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1412-327-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1628-185-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1628-190-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1736-256-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1736-253-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1860-159-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1860-154-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1944-149-0x0000000000400000-0x0000000000466000-memory.dmp
memory/1944-144-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2012-83-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2012-81-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2068-284-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2068-287-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2176-118-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2176-116-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2180-303-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2180-300-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2204-47-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2204-45-0x0000000000400000-0x0000000000466000-memory.dmp
memory/2792-199-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3024-37-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3024-2-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3024-3-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3024-4-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3024-0-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3324-55-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3324-54-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3348-134-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3348-139-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3400-179-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3400-174-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3460-92-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3460-90-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3616-239-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3616-234-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3720-219-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3720-215-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3796-99-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3844-311-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3844-308-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3916-352-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3916-341-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3916-339-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3988-164-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3988-169-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3992-292-0x0000000000400000-0x0000000000466000-memory.dmp
memory/3992-295-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4056-374-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4280-65-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4280-62-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4608-315-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4608-319-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4672-279-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4672-276-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4936-331-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4936-335-0x0000000000400000-0x0000000000466000-memory.dmp
memory/4956-263-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5056-205-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5056-209-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5088-271-0x0000000000400000-0x0000000000466000-memory.dmp
memory/5088-268-0x0000000000400000-0x0000000000466000-memory.dmp