darkvision | 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/02/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Size 515KB
Sample260227-1ect3sgy4e
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery darkvision rat

Malware Config

Extracted

Family

darkvision

185.241.211.30

Attributes

url
https://relyaccessed-virtual.info/dmo/PASSWORDRECOVERY32EXE.EXE

https://relyaccessed-virtual.info/dmo/PASSWORDRECOVERY64EXE.EXE

https://relyaccessed-virtual.info/dmo/upload.php
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:64.0) Gecko/20100101 Firefox/64.0

Signatures

DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	2904	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
3384	sonGod

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sonGod

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2004	EXPLORER.EXE
2004	EXPLORER.EXE
5872	EXPLORER.EXE
5872	EXPLORER.EXE
5668	EXPLORER.EXE
5668	EXPLORER.EXE
5304	EXPLORER.EXE
5304	EXPLORER.EXE
5204	EXPLORER.EXE
5204	EXPLORER.EXE
2524	EXPLORER.EXE
2524	EXPLORER.EXE
2052	EXPLORER.EXE
2052	EXPLORER.EXE
3700	EXPLORER.EXE
3700	EXPLORER.EXE
5944	EXPLORER.EXE
5944	EXPLORER.EXE
3884	EXPLORER.EXE
3884	EXPLORER.EXE
4360	EXPLORER.EXE
4360	EXPLORER.EXE
4424	EXPLORER.EXE
4424	EXPLORER.EXE
3180	EXPLORER.EXE
3180	EXPLORER.EXE
4812	EXPLORER.EXE
4812	EXPLORER.EXE
3364	EXPLORER.EXE
3364	EXPLORER.EXE

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3384	sonGod
3384	sonGod
3384	sonGod
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2004	EXPLORER.EXE
2004	EXPLORER.EXE
2004	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
5872	EXPLORER.EXE
5872	EXPLORER.EXE
5872	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
5668	EXPLORER.EXE
5668	EXPLORER.EXE
5668	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
5304	EXPLORER.EXE
5304	EXPLORER.EXE
5304	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
5204	EXPLORER.EXE
5204	EXPLORER.EXE
5204	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2524	EXPLORER.EXE
2524	EXPLORER.EXE
2524	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
2052	EXPLORER.EXE
2052	EXPLORER.EXE
2052	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
3700	EXPLORER.EXE
3700	EXPLORER.EXE
3700	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
5944	EXPLORER.EXE
5944	EXPLORER.EXE
5944	EXPLORER.EXE
2904	explorer.exe
2904	explorer.exe
2904	explorer.exe
3884	EXPLORER.EXE
3884	EXPLORER.EXE
3884	EXPLORER.EXE
2904	explorer.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3384	2856	2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe	80
PID 3384 wrote to memory of 2904	3384	sonGod	81
PID 2904 wrote to memory of 2004	2904	explorer.exe	82
PID 2904 wrote to memory of 5872	2904	explorer.exe	86
PID 2904 wrote to memory of 5668	2904	explorer.exe	89
PID 2904 wrote to memory of 5304	2904	explorer.exe	92
PID 2904 wrote to memory of 5204	2904	explorer.exe	95
PID 2904 wrote to memory of 2524	2904	explorer.exe	98
PID 2904 wrote to memory of 2052	2904	explorer.exe	101
PID 2904 wrote to memory of 3700	2904	explorer.exe	104
PID 2904 wrote to memory of 5944	2904	explorer.exe	107
PID 2904 wrote to memory of 3884	2904	explorer.exe	110
PID 2904 wrote to memory of 4360	2904	explorer.exe	113
PID 2904 wrote to memory of 4424	2904	explorer.exe	116
PID 2904 wrote to memory of 3180	2904	explorer.exe	119
PID 2904 wrote to memory of 4812	2904	explorer.exe	122
PID 2904 wrote to memory of 3364	2904	explorer.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-02-27_0178710262690d5cab0c509c9007ff94_amadey_darkgate_elex_redline-stealer_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2856
- C:\ProgramData\sonGod\sonGod
  "C:\ProgramData\sonGod\sonGod" {898607CD-2010-4EED-941A-86F08E5EB609}
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Downloads MZ/PE file
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4752
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1072
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5600
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5304
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2356
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3496
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2524
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3840
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2052
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2112
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5352
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:5944
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:2684
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3884
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:5012
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4360
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1356
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1068
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4732
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:4944
  - - C:\Windows\EXPLORER.EXE
      C:\Windows\EXPLORER.EXE {0B70AC1C-3EDF-4D94-B7BE-B6105D18B1C9}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:1472

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4888

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3964

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2088

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3288

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:476

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2920

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sonGod

Path C:\ProgramData\sonGod\sonGod
Size 515KB
SHA256 72251efffd4cc251a61e472671537b59a6925731b886a95ea2334b03566762e7
MD5 0178710262690d5cab0c509c9007ff94
SHA1 eef94e6bf16898c0f1f64a6fa8d39ca91363eb4c
SHA512 8062778c0af5a3ce83c3f0fec79d408643c518f495a0acbac2db18594996ba196bc90769087daae74cb4ece38fe1320dde26fabbc50eca8026dddde2a1cdeaf7
SSDEEP 12288:egRtI9FsQBmrCYmxuPY98Cmm1JwaIC3Ww:eiGmrVmxuPnCXztW
TLSH
T1E8B4AE11E660D233D47650B4CBE9C327E928BE716B0018E7A3D95FA71F355E2A930B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 4f81904a9b06c58572a0e5769b3b4ffb99e7bd4be88ee8c2b64a804f483d9dc6
MD5 09a22b1bcd9725df5b3591ebbd2cebd6
SHA1 9ac352c38bb6a94ab949aced3d8ef6c302cf5cd3
SHA512 c3a4f219bb9a692512f649fdd4b73a031aea6409572497a35acc03fe259db1739d5ab534d56cb0b1208f9b4e767d22f523e1c0ad333a6c420ada122de3e225fb
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

DATABASE

Path C:\Users\Admin\AppData\Local\Temp\DATABASE
Size 56KB
SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
MD5 fe8c5fb9ed4218996d10e03d7f45f1ec
SHA1 e394d2de480259243fde14f8ecbf7682f7c845e5
SHA512 66f8bc3f3f092a9395f079ff000acf492ca96d51790c1265ac2e555a771fe2705b20e12a964884f27d333649c6a003a2a473dae74107b51730c0cf2d737dd46e
SSDEEP 96:dpfmG38t8KLPeymO7CGr8M5bn8MouB6w9fUPetSEPfNy:dpD07CGr8MV7Iw9f1N
TLSH
T1DA43771F1B682802CC698632ACB194F36F7CA13F8F539E922CB444359D75862B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lwWpHtxGTv

Path C:\Users\Admin\AppData\Local\Temp\lwWpHtxGTv
Size 32B
SHA256 981c74b6a36474ea95f9f0197fa967c6dd13d0509606c4ae4c59f02c6c386adf
MD5 11bc034eafe552a5eeabbbf56acc1a34
SHA1 9397b03023f9958fc8168eb2e29b5e78f029b6c2
SHA512 00b9dc0b27a82440a87ccff7d833e3e9b1974ed496d794af813da96e234d4f67a22d5e31fe1a28b7b71387a1fd4c51a4972298b161058c32d643b2942e63a4ca
MD5 SHA1 SHA512

Submit Download

niSSuFqbdB

Path C:\Users\Admin\AppData\Local\Temp\niSSuFqbdB
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-30-0x0000000002620000-0x000000000272A000-memory.dmp

Download

memory/2004-16-0x0000000002620000-0x000000000272A000-memory.dmp

Download

memory/2004-22-0x0000000002620000-0x000000000272A000-memory.dmp

Download

memory/2004-15-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2004-32-0x0000000002DC0000-0x0000000002DD2000-memory.dmp

Download

memory/2004-31-0x0000000002560000-0x00000000025CF000-memory.dmp

Download

memory/2004-29-0x0000000000800000-0x0000000000801000-memory.dmp

Download

memory/2052-142-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/2052-148-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/2052-157-0x0000000002C10000-0x0000000002D1A000-memory.dmp

Download

memory/2052-158-0x0000000002D20000-0x0000000002D8F000-memory.dmp

Download

memory/2524-121-0x0000000002760000-0x000000000286A000-memory.dmp

Download

memory/2524-127-0x0000000002760000-0x000000000286A000-memory.dmp

Download

memory/2524-137-0x0000000002C50000-0x0000000002CBF000-memory.dmp

Download

memory/2524-136-0x0000000002760000-0x000000000286A000-memory.dmp

Download

memory/2856-4-0x0000000002FE0000-0x00000000035E2000-memory.dmp

Download

memory/2904-35-0x0000000002650000-0x00000000026BF000-memory.dmp

Download

memory/2904-5-0x0000000000900000-0x0000000000902000-memory.dmp

Download

memory/2904-36-0x0000000002BD0000-0x0000000002BE2000-memory.dmp

Download

memory/2904-7-0x00000000025B0000-0x0000000002622000-memory.dmp

Download

memory/2904-14-0x00000000025B0000-0x0000000002622000-memory.dmp

Download

memory/2904-13-0x00000000025B0000-0x0000000002622000-memory.dmp

Download

memory/2904-33-0x00000000025B0000-0x0000000002622000-memory.dmp

Download

memory/3180-266-0x0000000002370000-0x000000000247A000-memory.dmp

Download

memory/3180-272-0x0000000002370000-0x000000000247A000-memory.dmp

Download

memory/3180-280-0x0000000002370000-0x000000000247A000-memory.dmp

Download

memory/3180-281-0x00000000027C0000-0x000000000282F000-memory.dmp

Download

memory/3384-34-0x0000000002AA0000-0x00000000030A2000-memory.dmp

Download

memory/3700-163-0x00000000031B0000-0x00000000032BA000-memory.dmp

Download

memory/3700-178-0x0000000001930000-0x000000000199F000-memory.dmp

Download

memory/3700-177-0x00000000031B0000-0x00000000032BA000-memory.dmp

Download

memory/3700-169-0x00000000031B0000-0x00000000032BA000-memory.dmp

Download

memory/3884-210-0x0000000002DB0000-0x0000000002EBA000-memory.dmp

Download

memory/3884-218-0x0000000002DB0000-0x0000000002EBA000-memory.dmp

Download

memory/3884-204-0x0000000002DB0000-0x0000000002EBA000-memory.dmp

Download

memory/3884-219-0x0000000002F30000-0x0000000002F9F000-memory.dmp

Download

memory/4360-230-0x0000000003050000-0x000000000315A000-memory.dmp

Download

memory/4360-240-0x00000000017A0000-0x000000000180F000-memory.dmp

Download

memory/4360-239-0x0000000003050000-0x000000000315A000-memory.dmp

Download

memory/4360-224-0x0000000003050000-0x000000000315A000-memory.dmp

Download

memory/4424-260-0x00000000021A0000-0x00000000022AA000-memory.dmp

Download

memory/4424-261-0x00000000022B0000-0x000000000231F000-memory.dmp

Download

memory/4424-251-0x00000000021A0000-0x00000000022AA000-memory.dmp

Download

memory/4424-245-0x00000000021A0000-0x00000000022AA000-memory.dmp

Download

memory/5204-116-0x0000000000B20000-0x0000000000B8F000-memory.dmp

Download

memory/5204-115-0x0000000002350000-0x000000000245A000-memory.dmp

Download

memory/5204-100-0x0000000002350000-0x000000000245A000-memory.dmp

Download

memory/5204-106-0x0000000002350000-0x000000000245A000-memory.dmp

Download

memory/5304-95-0x0000000002980000-0x00000000029EF000-memory.dmp

Download

memory/5304-79-0x0000000002A70000-0x0000000002B7A000-memory.dmp

Download

memory/5304-85-0x0000000002A70000-0x0000000002B7A000-memory.dmp

Download

memory/5304-94-0x0000000002A70000-0x0000000002B7A000-memory.dmp

Download

memory/5668-74-0x0000000002950000-0x00000000029BF000-memory.dmp

Download

memory/5668-73-0x0000000001010000-0x000000000111A000-memory.dmp

Download

memory/5668-64-0x0000000001010000-0x000000000111A000-memory.dmp

Download

memory/5668-58-0x0000000001010000-0x000000000111A000-memory.dmp

Download

memory/5872-52-0x0000000002D80000-0x0000000002E8A000-memory.dmp

Download

memory/5872-53-0x0000000001460000-0x00000000014CF000-memory.dmp

Download

memory/5872-44-0x0000000002D80000-0x0000000002E8A000-memory.dmp

Download

memory/5872-38-0x0000000002D80000-0x0000000002E8A000-memory.dmp

Download

memory/5944-199-0x0000000002E20000-0x0000000002E8F000-memory.dmp

Download

memory/5944-198-0x0000000002ED0000-0x0000000002FDA000-memory.dmp

Download

memory/5944-184-0x0000000002ED0000-0x0000000002FDA000-memory.dmp

Download

memory/5944-189-0x0000000002ED0000-0x0000000002FDA000-memory.dmp

Download