Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 22:49
General
- Target 2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe
- Size 523KB
- Sample261011-2rx68ass7j
- SHA256 52ab4cb14e7ada055bad3aeb3a9a0e946978436f6b71955931fbbca209c49fd6
Malware Config
Signatures
- Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Detects Floxif payload 1 IoCs
- UPX dump on OEP (original entry point) 64 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Loads dropped DLL 64 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable 44 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 22 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exeC:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /TI3⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender:4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.exe" /EXP |3216|4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
symsrv.dll
symsrv.dll.000
2026-10-10_026c9329b2d7e897d3322d0116068657_coinminer_elex_floxif.ini
4r9l0h4a.tmp
F9209481328.tmp
1u9v1t6i.tmp
5z0p9w6r.tmp
autFBD0.tmp
autFBE0.tmp
autFBF1.tmp
memory/464-337-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/464-366-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/464-367-0x0000000010000000-0x0000000010030000-memory.dmp
memory/464-339-0x0000000003250000-0x0000000003280000-memory.dmp
memory/464-340-0x0000000003250000-0x0000000003280000-memory.dmp
memory/464-338-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1252-577-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1252-575-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1252-551-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1252-550-0x0000000003220000-0x0000000003250000-memory.dmp
memory/1516-231-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1516-232-0x0000000001600000-0x0000000001630000-memory.dmp
memory/1516-257-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1516-233-0x0000000001600000-0x0000000001630000-memory.dmp
memory/1516-259-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1532-752-0x0000000001270000-0x00000000012A0000-memory.dmp
memory/1532-778-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1532-753-0x0000000001270000-0x00000000012A0000-memory.dmp
memory/1532-751-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1532-776-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1712-783-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1712-808-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1712-784-0x0000000003240000-0x0000000003270000-memory.dmp
memory/1712-810-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1712-785-0x0000000003240000-0x0000000003270000-memory.dmp
memory/1916-151-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1916-125-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1916-150-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/1928-444-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1928-448-0x0000000001200000-0x0000000001230000-memory.dmp
memory/1928-447-0x0000000001200000-0x0000000001230000-memory.dmp
memory/1928-474-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1928-472-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2252-197-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2252-223-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2252-224-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2252-198-0x00000000009F0000-0x0000000000A20000-memory.dmp
memory/2252-199-0x00000000009F0000-0x0000000000A20000-memory.dmp
memory/2348-375-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2348-401-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2348-403-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2348-376-0x0000000003240000-0x0000000003270000-memory.dmp
memory/2348-377-0x0000000003240000-0x0000000003270000-memory.dmp
memory/2364-653-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2364-658-0x0000000000A00000-0x0000000000A30000-memory.dmp
memory/2364-656-0x0000000000A00000-0x0000000000A30000-memory.dmp
memory/2364-681-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2364-683-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2808-544-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2808-519-0x00000000013F0000-0x0000000001420000-memory.dmp
memory/2808-543-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/2808-517-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2808-518-0x00000000013F0000-0x0000000001420000-memory.dmp
memory/3444-154-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-838-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-296-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-743-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-684-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-646-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-63-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3444-406-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-118-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-261-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3444-260-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-191-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3444-779-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-190-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-188-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-152-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-578-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-159-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-156-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-475-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-579-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3444-120-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-123-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3444-368-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3444-515-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3720-718-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3720-748-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3720-747-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3720-719-0x00000000001B0000-0x00000000001E0000-memory.dmp
memory/3720-720-0x00000000001B0000-0x00000000001E0000-memory.dmp
memory/3836-690-0x0000000002E60000-0x0000000002E90000-memory.dmp
memory/3836-688-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3836-713-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3836-689-0x0000000002E60000-0x0000000002E90000-memory.dmp
memory/3836-715-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3936-268-0x00000000011C0000-0x00000000011F0000-memory.dmp
memory/3936-293-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/3936-267-0x00000000011C0000-0x00000000011F0000-memory.dmp
memory/3936-269-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3936-295-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4268-508-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4268-482-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4268-483-0x0000000000A50000-0x0000000000A80000-memory.dmp
memory/4268-485-0x0000000000A50000-0x0000000000A80000-memory.dmp
memory/4268-509-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4448-588-0x00000000009C0000-0x00000000009F0000-memory.dmp
memory/4448-612-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4448-586-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4448-589-0x00000000009C0000-0x00000000009F0000-memory.dmp
memory/4448-614-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4448-587-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4496-846-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4496-872-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4496-871-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4640-305-0x0000000000BA0000-0x0000000000BD0000-memory.dmp
memory/4640-331-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4640-329-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4640-302-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4640-304-0x0000000000BA0000-0x0000000000BD0000-memory.dmp
memory/4792-813-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4792-815-0x0000000002E50000-0x0000000002E80000-memory.dmp
memory/4792-842-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4792-840-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4792-814-0x0000000002E50000-0x0000000002E80000-memory.dmp
memory/4848-409-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4848-415-0x0000000000AC0000-0x0000000000AF0000-memory.dmp
memory/4848-414-0x0000000000AC0000-0x0000000000AF0000-memory.dmp
memory/4848-410-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4848-438-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4848-440-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4904-2-0x00000000004CC000-0x00000000004CD000-memory.dmp
memory/4904-0-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/4904-6-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4904-33-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4904-34-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5096-62-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5096-35-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5096-61-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5208-161-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5208-187-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5208-186-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5944-622-0x0000000001180000-0x00000000011B0000-memory.dmp
memory/5944-648-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/5944-649-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5944-620-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5944-621-0x0000000001180000-0x00000000011B0000-memory.dmp