Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
21/06/2024, 11:40
General
- Target 0b3517346b17f2e653c9eb7d0620af43_JaffaCakes118.exe
- Size 500KB
- Sample240621-ns91hssbln
- SHA256 a607e330e134a84d75426354c4eb7e8986b88a8a659e18358cd5c4e8848c27d4
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 44 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 44 IoCs
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 44 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b3517346b17f2e653c9eb7d0620af43_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0b3517346b17f2e653c9eb7d0620af43_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Users\Admin\AppData\Local\Temp\0B3517~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdwx32.exe"C:\Windows\system32\igfxdwx32.exe" C:\Windows\SysWOW64\IGFXDW~1.EXE45⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
igfxdwx32.exe
memory/872-107-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1128-84-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1404-127-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1432-156-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1496-80-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1536-179-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1536-101-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1672-164-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1672-161-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1676-49-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1676-52-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1696-94-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1960-66-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1960-70-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1980-162-0x0000000000400000-0x000000000047D000-memory.dmp
memory/1980-166-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2012-60-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2012-56-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2288-64-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2288-67-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2312-147-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2400-104-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2400-100-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2436-73-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2488-90-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2488-169-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2488-167-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2848-151-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2868-133-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2868-138-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2956-172-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2956-170-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2996-121-0x0000000000400000-0x000000000047D000-memory.dmp
memory/2996-118-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3040-0-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3040-36-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/3040-37-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3040-1-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/3080-110-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3140-149-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3140-154-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3168-63-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3220-55-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3364-77-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3364-74-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3388-41-0x0000000000020000-0x0000000000024000-memory.dmp
memory/3388-48-0x0000000000020000-0x0000000000024000-memory.dmp
memory/3388-47-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3460-141-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3632-92-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3632-98-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3704-113-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3876-44-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/3876-43-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3876-38-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3876-39-0x00000000001C0000-0x00000000001C4000-memory.dmp
memory/3900-131-0x0000000000400000-0x000000000047D000-memory.dmp
memory/3900-125-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4172-117-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4172-114-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4224-87-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4224-82-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4440-160-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4492-175-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4492-177-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4548-158-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4624-135-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4816-144-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4864-123-0x0000000000400000-0x000000000047D000-memory.dmp
memory/4904-174-0x0000000000400000-0x000000000047D000-memory.dmp