Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
06/02/2024, 02:39
General
- Target 939ee3fe101534a4f62dfb159da958e1.exe
- Size 239KB
- Sample240206-c5e55afcel
- SHA256 818b5257f61e7ccc2876a9e6ced05c1c9ceca7d4fce2ff3e113c351a7afe922a
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 47 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 47 IoCs
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 47 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\939ee3fe101534a4f62dfb159da958e1.exe"C:\Users\Admin\AppData\Local\Temp\939ee3fe101534a4f62dfb159da958e1.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Users\Admin\AppData\Local\Temp\939EE3~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE46⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE47⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdmv32.exe"C:\Windows\system32\igfxdmv32.exe" C:\Windows\SysWOW64\IGFXDM~1.EXE48⤵
- Executes dropped EXE
- Maps connected drives based on registry
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
igfxdmv32.exe
igfxdmv32.exe
igfxdmv32.exe
igfxdmv32.exe
igfxdmv32.exe
memory/776-196-0x0000000000400000-0x0000000000494000-memory.dmp
memory/844-47-0x0000000000400000-0x0000000000494000-memory.dmp
memory/844-44-0x0000000000610000-0x0000000000611000-memory.dmp
memory/844-43-0x0000000000600000-0x0000000000604000-memory.dmp
memory/844-42-0x0000000000400000-0x0000000000494000-memory.dmp
memory/844-40-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1040-73-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1040-69-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/1040-76-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/1040-70-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1080-39-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1080-0-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1080-41-0x0000000000570000-0x0000000000574000-memory.dmp
memory/1080-4-0x0000000000580000-0x0000000000581000-memory.dmp
memory/1080-1-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1080-3-0x0000000000570000-0x0000000000574000-memory.dmp
memory/1080-2-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1116-222-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1232-109-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1232-108-0x0000000000520000-0x0000000000524000-memory.dmp
memory/1232-113-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1232-114-0x0000000000520000-0x0000000000524000-memory.dmp
memory/1252-50-0x0000000002210000-0x0000000002211000-memory.dmp
memory/1252-55-0x0000000000530000-0x0000000000534000-memory.dmp
memory/1252-48-0x0000000000530000-0x0000000000534000-memory.dmp
memory/1252-49-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1252-53-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1348-91-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1348-93-0x0000000000530000-0x0000000000534000-memory.dmp
memory/1348-89-0x0000000000530000-0x0000000000534000-memory.dmp
memory/1348-88-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1456-116-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1456-119-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1456-120-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/1456-115-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/1548-208-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2016-178-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2160-130-0x0000000000800000-0x0000000000804000-memory.dmp
memory/2160-124-0x0000000000820000-0x0000000000821000-memory.dmp
memory/2160-123-0x0000000000800000-0x0000000000804000-memory.dmp
memory/2160-122-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2160-121-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2160-128-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2172-213-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2252-141-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2252-135-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2252-136-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2252-137-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/2300-87-0x0000000000600000-0x0000000000604000-memory.dmp
memory/2300-81-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2300-82-0x0000000000600000-0x0000000000604000-memory.dmp
memory/2300-86-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2720-102-0x0000000000520000-0x0000000000524000-memory.dmp
memory/2720-106-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2720-103-0x0000000000540000-0x0000000000541000-memory.dmp
memory/2720-101-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2720-107-0x0000000000520000-0x0000000000524000-memory.dmp
memory/2780-164-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3028-185-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3048-143-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3048-142-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3048-144-0x00000000005F0000-0x00000000005F4000-memory.dmp
memory/3048-148-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3116-154-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3116-155-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/3116-159-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3404-153-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3404-156-0x0000000000520000-0x0000000000524000-memory.dmp
memory/3404-149-0x0000000000520000-0x0000000000524000-memory.dmp
memory/3404-147-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3636-217-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3756-65-0x0000000000590000-0x0000000000591000-memory.dmp
memory/3756-67-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3756-64-0x0000000000580000-0x0000000000584000-memory.dmp
memory/3756-63-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3796-172-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3888-60-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3888-62-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/3888-56-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3888-57-0x00000000020A0000-0x00000000020A4000-memory.dmp
memory/3888-58-0x00000000020C0000-0x00000000020C1000-memory.dmp
memory/4000-129-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4000-131-0x00000000005F0000-0x00000000005F4000-memory.dmp
memory/4000-134-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4020-79-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4020-77-0x0000000000600000-0x0000000000604000-memory.dmp
memory/4020-75-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4020-74-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4092-231-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4432-95-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4432-100-0x00000000005F0000-0x00000000005F4000-memory.dmp
memory/4432-98-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4432-96-0x0000000000600000-0x0000000000601000-memory.dmp
memory/4432-94-0x00000000005F0000-0x00000000005F4000-memory.dmp
memory/4660-203-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4820-192-0x0000000000400000-0x0000000000494000-memory.dmp