565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56

Analysis

user interaction
yes
max time kernel
66s
max time network
63s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe
Size 1.4MB
Sample260819-rb89fack6x
SHA256 565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56
MD5 38981196a3a04fa8f5142ce4459c47c8
SHA1 3db51f218b9a3c6dd68f282407a8dc3e62ca2ab4
SHA512 7c6de6d35ddf51135e1ef93397ebd2dbcf4ecbe509b08120014bfe99a82a99a9fb98c41fe85b7c12f611717c7468a370fcbe7c6a3b401ae982ba62bf4b044dac
SSDEEP 24576:OXWftVq6ZP732cZxAhw/68mK8ywVDY92DLR/P/r1fFMGMbl998MicJ:OXWFsUWhw/68mK8lMUCR
TLSH
T13465CF1DE38C12E9D627C534CBA29632E775B8460B61BADB079DC2152F739D02F3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation ransomware

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
1852	WScript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3200 set thread context of 1400	3200	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	85

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3520	Notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe
1400	jsc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1784	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1400	jsc.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 1400	3200	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	85
PID 3200 wrote to memory of 1400	3200	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	85
PID 3200 wrote to memory of 1400	3200	565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe	85
PID 1864 wrote to memory of 1784	1864	msedge.exe	95
PID 1784 wrote to memory of 3408	1784	msedge.exe	96
PID 1784 wrote to memory of 1756	1784	msedge.exe	97
PID 1784 wrote to memory of 908	1784	msedge.exe	98
PID 1784 wrote to memory of 908	1784	msedge.exe	98
PID 1784 wrote to memory of 908	1784	msedge.exe	98
PID 1784 wrote to memory of 4060	1784	msedge.exe	99
PID 1784 wrote to memory of 4060	1784	msedge.exe	99
PID 1784 wrote to memory of 4760	1784	msedge.exe	100
PID 1784 wrote to memory of 4760	1784	msedge.exe	100
PID 1784 wrote to memory of 4760	1784	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe
"C:\Users\Admin\AppData\Local\Temp\565b9d34568309464c1ae39912cd9e941188a43c6f3bc110f8880f6790199d56.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf054b39bha558h4fc1h9380h995d07d3c1c0
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultf054b39bha558h4fc1h9380h995d07d3c1c0 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ffb19d4c188,0x7ffb19d4c194,0x7ffb19d4c1a0
    3⤵
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16500828736273025988,11368981823427966889,524288 --field-trial-handle=2292,i,4774245083534357492,14493796854296297463,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,13111331788681079586,9144025845572758991,262144 --field-trial-handle=2292,i,4774245083534357492,14493796854296297463,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,12142360575314935867,12524894050041981807,524288 --field-trial-handle=2292,i,4774245083534357492,14493796854296297463,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3152,i,10251592395398270382,5918317462247016190,2097152 --field-trial-handle=2292,i,4774245083534357492,14493796854296297463,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:2
    3⤵
    PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2664

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\UpdateRead.vbe"
1⤵
- Executes a VBScript file via the Windows Script Host.
PID:1852

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\UpdateRead.vbe
1⤵
- Opens file in notepad (likely ransom note)
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 0bbf547831f4b66d7fcef5df1a7568107274688d83500b3707054f7c6b9e9d50
MD5 46b7560739766f4b737a914308904912
SHA1 d47f7d4f97e3606c92074f17f219049d5a31dc98
SHA512 397a4031bb612ca8780f704a2a8ebfcd0bee789fb6f9d0ca709526a9cf17d831316d5f47e77efe10826ce03e1370a5054821ee1aefd6b24b8fcdf7c672829205
SSDEEP 96:sa2jKiEDWypscUb9POcwdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjnI67HwUhgNr:sxOuAszKrpMHW6+WNGYqxhgF
TLSH
T180F1C9526E68697B4CC7E11DBB267B53E2F9503176D5194CEBFC8A1C089B6CD230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 3f16dcf0cc883d43bb9fe1cae89a7a2135f9845de80a330b36a78e1b45cf7bdf
MD5 259e2d8e52d52a196db93dd60e05d0b1
SHA1 df43aa32908eb81832f7d434dda9504d5d7ee101
SHA512 13a5badfb198f15dbac1ca6d6326b7c387523e06aab9a6cfc36527158092d5f059941da2652c80e369bab5b0a3471aa4aad62c88b4a42e334c2e5331ab8dbc63
SSDEEP 768:JIO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJbyroo/:JIO6fP1Wvxz3ju1jaZILIsbpo/
TLSH
T123C2E93B240DCB7E4F801A9DAC5A6F977E9802C7AB688D4447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e590199c21fe058764a8cf79672618a5570e723348074fcac55896d4c40da270
MD5 93c593a22c8714290a335bbbd5eb267e
SHA1 e687b82b8190f7ee7278dde278529e3ff8698751
SHA512 75f12d5601f08732076af020905727bee00dccce42841b42b8e0ab8ac48d10333dc167b7a3745b325843f7ae772f37d7203addd76026f9a61c478bdec6b5d8a9
SSDEEP 192:zwsNc6O7+3vNQmiUymloatb0aO2eh2dsLEdcM+ntqCiDUO:zwsNc69LZoa97ORMKoDSxiUO
TLSH
T1BE120970686CAC7759E3A145F98737639FA51077DC8A2F84E6D85F0C00D769C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ada69f98930282fdc1e8b47946a84edca43028be243e901300a92998bedda20a
MD5 a9ec5ec85b260d7738a9a2797f103b5f
SHA1 45e22322222b28b05b542b3f17c0c0c2fef1426a
SHA512 37f0991c2aaa434775843dea261444b6fa0f0290275b28d129387a9d37e0362b702cb8dadcc000961a1af8ee5165aadca66e26f4bf755c0512971c19c3c42d00
SSDEEP 192:qONa6O7+3hQmiUyq+Gttb0aO2eh2dqgGuvcU6:qONa61MGt97ORMau0U6
TLSH
T12102F9346D686CB74EF2AD46FA8737239FA5103BE9952F84DAE81F1C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d351c290b8d13bae0f2cd3737b8cd0be8085430bdbcc035bc41777524f93a393
MD5 961ecb7ece2132852c0d3c46311e0b63
SHA1 2ee98285b05f6497cfdf2a6c25a13d0bc0af21fb
SHA512 2fbbbd70b97280569d82a69616714e5351f14ecd2f1632ed86b02df5e5d0ea4085ac76a20f0245c22f450109c462ddf395f21043de3681a14a8087cf8a6ad4f5
SSDEEP 192:4ONr6O7+3EQmiUyu+ottb0aO2eh2dsLEdcNutqCiDU6:4ONr6iyot97ORMKo6uxiU6
TLSH
T1A3121970686CAC671EE2B145F9C737939FA4107BEC866F84E6D85E1C00D769C334A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 4584155d7e44de14d0a69d711f2d81e79326606756e165ade6ed35d49263751c
MD5 383b1e6d37833609317ddd431cfa9d87
SHA1 e29a824f396a4026b1e5da258607595ab4b99e61
SHA512 a238f92e80e5e7f20e72b6d398e7af6488d65fd6ac1f70e9b6d5c268d6be0d73fa6849872ab86a519f4cc0bac2aa2eb4cee10901eca4005ffab6e7228d1873b3
SSDEEP 192:zwsNc6O7+3vNQmiUyNloatb0aO2eh2dsLEdcM+ntqCiDUO:zwsNc69LOoa97ORMKoDSxiUO
TLSH
T1DA120870686CAC7759E3A145F98737A39FA4107BDC8A2F84E6D85F0C00D769C334A82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1400-70-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-58-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-62-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-130-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-128-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-126-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-122-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-120-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-118-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-116-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-114-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-112-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-110-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-108-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-104-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-102-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-100-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-98-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-96-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-94-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-92-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-88-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-86-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-84-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-82-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-80-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-78-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-76-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-74-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-72-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-11-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-68-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-66-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-64-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-60-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-18-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-125-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-54-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-52-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-50-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-48-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-106-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-46-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-44-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-42-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-40-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-38-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-36-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-90-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-34-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-32-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-30-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-28-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-26-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-24-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-20-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-16-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-14-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-12-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-56-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-10-0x0000000005730000-0x000000000575C000-memory.dmp

Download

memory/1400-9-0x0000000005580000-0x000000000559A000-memory.dmp

Download

memory/1400-8-0x0000000005620000-0x0000000005630000-memory.dmp

Download

memory/1400-7-0x0000000000F60000-0x0000000000FCE000-memory.dmp

Download

memory/1400-4-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/1400-6-0x0000000000F60000-0x0000000000FCE000-memory.dmp

Download

memory/1400-1-0x0000000000F60000-0x0000000000FCE000-memory.dmp

Download

memory/1400-22-0x0000000005730000-0x0000000005756000-memory.dmp

Download

memory/1400-639-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Download

memory/1400-642-0x0000000006C70000-0x0000000006D02000-memory.dmp

Download

memory/1400-643-0x00000000072C0000-0x0000000007864000-memory.dmp

Download

memory/1400-644-0x0000000005620000-0x0000000005630000-memory.dmp

Download