Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
20/06/2024, 04:26
General
- Target 02cb022f503bbef3b833f920dd8fb6c2_JaffaCakes118.exe
- Size 329KB
- Sample240620-e2ljvatamk
- SHA256 3469692e0429097f567c960b9805a205c2b232fedb42fd47c2b0cc3a4f0eb00f
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 43 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 43 IoCs
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 44 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 43 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02cb022f503bbef3b833f920dd8fb6c2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02cb022f503bbef3b833f920dd8fb6c2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Users\Admin\AppData\Local\Temp\02CB02~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxsvr86.exe"C:\Windows\system32\igfxsvr86.exe" C:\Windows\SysWOW64\IGFXSV~1.EXE44⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
igfxsvr86.exe
memory/224-151-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/224-111-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/232-130-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/232-134-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/432-131-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/996-195-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/996-190-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1288-204-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1552-138-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1556-155-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1556-161-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1600-106-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1784-178-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1884-115-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1884-120-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1912-72-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/1912-69-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2052-164-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2052-170-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2160-52-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2372-148-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2624-93-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2624-95-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2872-47-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2872-43-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2872-42-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2872-41-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2908-104-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/2908-100-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3004-56-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3144-0-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3144-2-0x0000000000480000-0x00000000004A2000-memory.dmp
memory/3144-39-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3144-3-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3144-1-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3144-40-0x0000000000480000-0x00000000004A2000-memory.dmp
memory/3144-4-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3464-198-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3464-193-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3616-85-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3616-89-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3708-58-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3708-166-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3708-61-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3768-78-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/3768-81-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4008-86-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4020-123-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4020-119-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4132-187-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4132-184-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4196-65-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4232-66-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4232-70-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4352-126-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4404-101-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4448-182-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4456-156-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4460-92-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4480-201-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4588-145-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4588-142-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4592-141-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4608-173-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4656-116-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4656-112-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4740-191-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/4772-205-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/5024-74-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/5024-79-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/5040-46-0x0000000000400000-0x00000000004B2000-memory.dmp
memory/5040-49-0x0000000000400000-0x00000000004B2000-memory.dmp