Analysis
- max time kernel
149s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
23/06/2024, 04:27
General
- Target 0531f71bdc212a056713b7e98e3977cf_JaffaCakes118.exe
- Size 255KB
- Sample240623-e3fd8atdkj
- SHA256 1960b1006570ac63af82c3fb1b307c17b2412b6257b5c6450439d103c1896f34
Malware Config
Extracted
-
metasploit
-
encoder/call4_dword_xor
Signatures
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Checks computer location settings 2 TTPs 45 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Executes dropped EXE 45 IoCs
- Maps connected drives based on registry 3 TTPs 64 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 46 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 45 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0531f71bdc212a056713b7e98e3977cf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0531f71bdc212a056713b7e98e3977cf_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Users\Admin\AppData\Local\Temp\0531F7~1.EXE2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE3⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE4⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE5⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE7⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE9⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE10⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE11⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE12⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE13⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE14⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE15⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE16⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE17⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE18⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE19⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE20⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE21⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE22⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE23⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE24⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE25⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE26⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE27⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE28⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE29⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE30⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE31⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE32⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE33⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE34⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE35⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE36⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE37⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE38⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE39⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE40⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE41⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE42⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE43⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE44⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE45⤵
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
-
C:\Windows\SysWOW64\igfxdct64.exe"C:\Windows\system32\igfxdct64.exe" C:\Windows\SysWOW64\IGFXDC~1.EXE46⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
igfxdct64.exe
memory/60-199-0x0000000000400000-0x0000000000494000-memory.dmp
memory/60-194-0x0000000000400000-0x0000000000494000-memory.dmp
memory/100-156-0x0000000000400000-0x0000000000494000-memory.dmp
memory/100-160-0x0000000000400000-0x0000000000494000-memory.dmp
memory/832-214-0x0000000000400000-0x0000000000494000-memory.dmp
memory/832-217-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1048-179-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1048-173-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1104-248-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1104-103-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1104-106-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1104-244-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1304-88-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1304-85-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1388-142-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1388-146-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1516-232-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1516-235-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1556-90-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1556-94-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1672-67-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1672-63-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1724-100-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1724-95-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1888-48-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1888-44-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1888-42-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1888-43-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1960-131-0x0000000000400000-0x0000000000494000-memory.dmp
memory/1960-127-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2008-98-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2008-105-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2044-239-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2044-236-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2088-221-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2088-224-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2280-193-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2280-189-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2432-137-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2432-141-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2628-184-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2628-180-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2640-210-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2640-202-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2644-40-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2644-39-0x0000000000477000-0x0000000000493000-memory.dmp
memory/2644-2-0x0000000000477000-0x0000000000493000-memory.dmp
memory/2644-1-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2644-0-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2644-3-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2644-4-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2692-79-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2736-165-0x0000000000400000-0x0000000000494000-memory.dmp
memory/2736-169-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3060-136-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3152-116-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3176-75-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3384-213-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3384-208-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3472-231-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3472-228-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-52-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-49-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-50-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-121-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-57-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3668-51-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3672-243-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3672-240-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3936-164-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3980-109-0x0000000000400000-0x0000000000494000-memory.dmp
memory/3980-113-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4124-155-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4156-84-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4156-80-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4312-188-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4316-204-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4316-197-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4324-122-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4324-126-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4444-58-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4444-62-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4496-175-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4508-149-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4732-227-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4776-246-0x0000000000400000-0x0000000000494000-memory.dmp
memory/4896-220-0x0000000000400000-0x0000000000494000-memory.dmp
memory/5052-71-0x0000000000400000-0x0000000000494000-memory.dmp