darkvision | 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/02/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 515KB
Sample260227-1ect3sgy4e
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darkvision rat

Malware Config

Extracted

Family

darkvision

185.241.211.30

Attributes

url
https://relyaccessed-virtual.info/dmo/PASSWORDRECOVERY32EXE.EXE

https://relyaccessed-virtual.info/dmo/PASSWORDRECOVERY64EXE.EXE

https://relyaccessed-virtual.info/dmo/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	1704	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
824	sonGod

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonGod

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3404	EXPLORER.EXE
3404	EXPLORER.EXE
3936	EXPLORER.EXE
3936	EXPLORER.EXE
1008	EXPLORER.EXE
1008	EXPLORER.EXE
3516	EXPLORER.EXE
3516	EXPLORER.EXE
1688	EXPLORER.EXE
1688	EXPLORER.EXE
3948	EXPLORER.EXE
3948	EXPLORER.EXE
2572	EXPLORER.EXE
2572	EXPLORER.EXE
3324	EXPLORER.EXE
3324	EXPLORER.EXE
4680	EXPLORER.EXE
4680	EXPLORER.EXE
2764	EXPLORER.EXE
2764	EXPLORER.EXE
3116	EXPLORER.EXE
3116	EXPLORER.EXE
4412	EXPLORER.EXE
4412	EXPLORER.EXE
3872	EXPLORER.EXE
3872	EXPLORER.EXE
1440	EXPLORER.EXE
1440	EXPLORER.EXE
3152	EXPLORER.EXE
3152	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
824	sonGod
824	sonGod
824	sonGod
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
3404	EXPLORER.EXE
3404	EXPLORER.EXE
3404	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
3936	EXPLORER.EXE
3936	EXPLORER.EXE
3936	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1008	EXPLORER.EXE
1008	EXPLORER.EXE
1008	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
3516	EXPLORER.EXE
3516	EXPLORER.EXE
3516	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
1688	EXPLORER.EXE
1688	EXPLORER.EXE
1688	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
3948	EXPLORER.EXE
3948	EXPLORER.EXE
3948	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
2572	EXPLORER.EXE
2572	EXPLORER.EXE
2572	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
3324	EXPLORER.EXE
3324	EXPLORER.EXE
3324	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
4680	EXPLORER.EXE
4680	EXPLORER.EXE
4680	EXPLORER.EXE
1704	explorer.exe
1704	explorer.exe
1704	explorer.exe
2764	EXPLORER.EXE
2764	EXPLORER.EXE
2764	EXPLORER.EXE
1704	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 824	4940	2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	87
PID 824 wrote to memory of 1704	824	sonGod	91
PID 1704 wrote to memory of 3404	1704	explorer.exe	93
PID 1704 wrote to memory of 3936	1704	explorer.exe	110
PID 1704 wrote to memory of 1008	1704	explorer.exe	113
PID 1704 wrote to memory of 3516	1704	explorer.exe	118
PID 1704 wrote to memory of 1688	1704	explorer.exe	129
PID 1704 wrote to memory of 3948	1704	explorer.exe	132
PID 1704 wrote to memory of 2572	1704	explorer.exe	135
PID 1704 wrote to memory of 3324	1704	explorer.exe	139
PID 1704 wrote to memory of 4680	1704	explorer.exe	142
PID 1704 wrote to memory of 2764	1704	explorer.exe	145
PID 1704 wrote to memory of 3116	1704	explorer.exe	148
PID 1704 wrote to memory of 4412	1704	explorer.exe	151
PID 1704 wrote to memory of 3872	1704	explorer.exe	154
PID 1704 wrote to memory of 1440	1704	explorer.exe	157
PID 1704 wrote to memory of 3152	1704	explorer.exe	160

C:\Users\Admin\AppData\Local\Temp\2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4940
- C:\ProgramData\sonGod\sonGod
  "C:\ProgramData\sonGod\sonGod" {898607CD-2010-4EED-941A-86F08E5EB609}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Downloads MZ/PE file
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2484
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3936
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4956
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1008
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:820
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1944
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4880
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1204
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:960
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1468
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3220
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1828
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2552
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4492
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3800
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1468
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3152
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3096

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3804

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sonGod

Path C:\ProgramData\sonGod\sonGod
Size 515KB
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KEvXJIsQTE

Path C:\Users\Admin\AppData\Local\Temp\KEvXJIsQTE
Size 32B
SHA256 9dc5470a191e8718be5d7278e0d5eb96427d0d50e653485b35fc1742ad7948c3
MD5 c71a79df6dd5861b9e237e3032cbd8d8
SHA1 c63b5b21395e0e3a0701225350fb383ac18c9314
SHA512 73237efb867289adfa117c0be965ceff56604fd004cb440159b93c27a92b010aa3dd1c647bc6d337d33995a9329565809fb5247870f8cbb085b1ad8a5a8796af
MD5 SHA1 SHA512

Submit Download

upbZcxhsKF

Path C:\Users\Admin\AppData\Local\Temp\upbZcxhsKF
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/744-72-0x0000011D97BC0000-0x0000011D97CEA000-memory.dmp

Download

memory/824-35-0x0000000000B60000-0x0000000000DE1000-memory.dmp

Download

memory/1008-79-0x0000000002B00000-0x0000000002C2A000-memory.dmp

Download

memory/1008-80-0x0000000000990000-0x000000000099C000-memory.dmp

Download

memory/1008-77-0x00000000029F0000-0x0000000002AFA000-memory.dmp

Download

memory/1008-68-0x00000000029F0000-0x0000000002AFA000-memory.dmp

Download

memory/1008-62-0x00000000029F0000-0x0000000002AFA000-memory.dmp

Download

memory/1688-126-0x00000000008A0000-0x00000000008AC000-memory.dmp

Download

memory/1688-114-0x0000000002730000-0x000000000283A000-memory.dmp

Download

memory/1688-108-0x0000000002730000-0x000000000283A000-memory.dmp

Download

memory/1688-123-0x0000000002730000-0x000000000283A000-memory.dmp

Download

memory/1688-125-0x0000000002840000-0x000000000296A000-memory.dmp

Download

memory/1704-34-0x0000000000AD0000-0x0000000000B42000-memory.dmp

Download

memory/1704-37-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Download

memory/1704-36-0x00000000023E0000-0x000000000250A000-memory.dmp

Download

memory/1704-6-0x0000000000AD0000-0x0000000000B42000-memory.dmp

Download

memory/1704-14-0x0000000000AD0000-0x0000000000B42000-memory.dmp

Download

memory/1704-5-0x0000000000640000-0x0000000000642000-memory.dmp

Download

memory/1704-13-0x0000000000AD0000-0x0000000000B42000-memory.dmp

Download

memory/1784-169-0x000002507EA60000-0x000002507EB8A000-memory.dmp

Download

memory/2572-171-0x0000000003120000-0x000000000324A000-memory.dmp

Download

memory/2572-154-0x0000000002F80000-0x000000000308A000-memory.dmp

Download

memory/2572-160-0x0000000002F80000-0x000000000308A000-memory.dmp

Download

memory/2572-172-0x0000000001290000-0x000000000129C000-memory.dmp

Download

memory/2572-168-0x0000000002F80000-0x000000000308A000-memory.dmp

Download

memory/2836-117-0x000002AD72F00000-0x000002AD7302A000-memory.dmp

Download

memory/3096-215-0x0000021A52AC0000-0x0000021A52BEA000-memory.dmp

Download

memory/3292-100-0x000001DD88470000-0x000001DD8859A000-memory.dmp

Download

memory/3324-192-0x0000000002800000-0x000000000290A000-memory.dmp

Download

memory/3324-195-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Download

memory/3324-183-0x0000000002800000-0x000000000290A000-memory.dmp

Download

memory/3324-177-0x0000000002800000-0x000000000290A000-memory.dmp

Download

memory/3324-194-0x0000000002970000-0x0000000002A9A000-memory.dmp

Download

memory/3404-30-0x00000000012C0000-0x00000000013CA000-memory.dmp

Download

memory/3404-32-0x0000000002D00000-0x0000000002E2A000-memory.dmp

Download

memory/3404-33-0x00000000013D0000-0x00000000013DC000-memory.dmp

Download

memory/3404-31-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/3404-15-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/3404-16-0x00000000012C0000-0x00000000013CA000-memory.dmp

Download

memory/3404-22-0x00000000012C0000-0x00000000013CA000-memory.dmp

Download

memory/3516-91-0x00000000028F0000-0x00000000029FA000-memory.dmp

Download

memory/3516-99-0x00000000028F0000-0x00000000029FA000-memory.dmp

Download

memory/3516-102-0x0000000002A30000-0x0000000002B5A000-memory.dmp

Download

memory/3516-103-0x0000000000E90000-0x0000000000E9C000-memory.dmp

Download

memory/3516-85-0x00000000028F0000-0x00000000029FA000-memory.dmp

Download

memory/3540-47-0x0000024596A40000-0x0000024596B6A000-memory.dmp

Download

memory/3936-56-0x0000000002B80000-0x0000000002CAA000-memory.dmp

Download

memory/3936-39-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/3936-45-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/3936-55-0x0000000000B10000-0x0000000000B12000-memory.dmp

Download

memory/3936-57-0x0000000000B00000-0x0000000000B0C000-memory.dmp

Download

memory/3936-54-0x0000000002A40000-0x0000000002B4A000-memory.dmp

Download

memory/3948-149-0x00000000004F0000-0x00000000004FC000-memory.dmp

Download

memory/3948-148-0x00000000023D0000-0x00000000024FA000-memory.dmp

Download

memory/3948-146-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/3948-131-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/3948-137-0x00000000022A0000-0x00000000023AA000-memory.dmp

Download

memory/4204-188-0x0000024BF5BD0000-0x0000024BF5CFA000-memory.dmp

Download

memory/4496-140-0x00000281B1C10000-0x00000281B1D3A000-memory.dmp

Download

memory/4680-200-0x0000000002330000-0x000000000243A000-memory.dmp

Download

memory/4680-206-0x0000000002330000-0x000000000243A000-memory.dmp

Download

memory/4680-216-0x0000000002330000-0x000000000243A000-memory.dmp

Download

memory/4884-24-0x000001A90D640000-0x000001A90D76A000-memory.dmp

Download

memory/4940-4-0x0000000001410000-0x0000000001691000-memory.dmp

Download