536063c9ca42859ec4e34c09d82e3978cb0dad25643a333aea536088a4894449

Analysis

user interaction
yes
max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
code.ps1
Size 13KB
Sample260822-2bl41szerc
SHA256 536063c9ca42859ec4e34c09d82e3978cb0dad25643a333aea536088a4894449
MD5 6e6e13428b136dc810e8af54e2de5714
SHA1 a28789b6d6fed11a074dd7f432e39050d93eca39
SHA512 e707ec43b9f40987fb45065b47b62500c45ab99271a514dcfc5abb92b34e402cc6a6dc78447f1b35462520dfea211e4b2bfde737615cd3412ddbdd3a54ba2c32
SSDEEP 384:ifSGZDpsjU/Kisi+vki9irbR1R46JAsCWM:zQGqzh+vZsrtpJ0WM
TLSH
T11652A6923D45349192739F36EAA3938EF635003B52170A14B99CC2D09FB5F3A87E5F88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command \"while($true){Start-Sleep -Seconds 1}\""	PowerShell.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3620	PowerShell.exe
8	3620	PowerShell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3620	PowerShell.exe
1380	powershell.exe
1600	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
1	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	api.ipify.org
1	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3452	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
1380	powershell.exe
4380	WMIC.exe
4380	WMIC.exe
4380	WMIC.exe
4380	WMIC.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe
1380	powershell.exe
1600	powershell.exe
1600	powershell.exe
1600	powershell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe
3620	PowerShell.exe
1380	powershell.exe
1380	powershell.exe
3620	PowerShell.exe
3620	PowerShell.exe
1380	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	PowerShell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeIncreaseQuotaPrivilege	3620	PowerShell.exe
Token: SeSecurityPrivilege	3620	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3620	PowerShell.exe
Token: SeLoadDriverPrivilege	3620	PowerShell.exe
Token: SeSystemProfilePrivilege	3620	PowerShell.exe
Token: SeSystemtimePrivilege	3620	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3620	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3620	PowerShell.exe
Token: SeCreatePagefilePrivilege	3620	PowerShell.exe
Token: SeBackupPrivilege	3620	PowerShell.exe
Token: SeRestorePrivilege	3620	PowerShell.exe
Token: SeShutdownPrivilege	3620	PowerShell.exe
Token: SeDebugPrivilege	3620	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3620	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3620	PowerShell.exe
Token: SeUndockPrivilege	3620	PowerShell.exe
Token: SeManageVolumePrivilege	3620	PowerShell.exe
Token: 33	3620	PowerShell.exe
Token: 34	3620	PowerShell.exe
Token: 35	3620	PowerShell.exe
Token: 36	3620	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3620	PowerShell.exe
Token: SeSecurityPrivilege	3620	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3620	PowerShell.exe
Token: SeLoadDriverPrivilege	3620	PowerShell.exe
Token: SeSystemProfilePrivilege	3620	PowerShell.exe
Token: SeSystemtimePrivilege	3620	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3620	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3620	PowerShell.exe
Token: SeCreatePagefilePrivilege	3620	PowerShell.exe
Token: SeBackupPrivilege	3620	PowerShell.exe
Token: SeRestorePrivilege	3620	PowerShell.exe
Token: SeShutdownPrivilege	3620	PowerShell.exe
Token: SeDebugPrivilege	3620	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3620	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3620	PowerShell.exe
Token: SeUndockPrivilege	3620	PowerShell.exe
Token: SeManageVolumePrivilege	3620	PowerShell.exe
Token: 33	3620	PowerShell.exe
Token: 34	3620	PowerShell.exe
Token: 35	3620	PowerShell.exe
Token: 36	3620	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3620	PowerShell.exe
Token: SeSecurityPrivilege	3620	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3620	PowerShell.exe
Token: SeLoadDriverPrivilege	3620	PowerShell.exe
Token: SeSystemProfilePrivilege	3620	PowerShell.exe
Token: SeSystemtimePrivilege	3620	PowerShell.exe
Token: SeProfSingleProcessPrivilege	3620	PowerShell.exe
Token: SeIncBasePriorityPrivilege	3620	PowerShell.exe
Token: SeCreatePagefilePrivilege	3620	PowerShell.exe
Token: SeBackupPrivilege	3620	PowerShell.exe
Token: SeRestorePrivilege	3620	PowerShell.exe
Token: SeShutdownPrivilege	3620	PowerShell.exe
Token: SeDebugPrivilege	3620	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3620	PowerShell.exe
Token: SeRemoteShutdownPrivilege	3620	PowerShell.exe
Token: SeUndockPrivilege	3620	PowerShell.exe
Token: SeManageVolumePrivilege	3620	PowerShell.exe
Token: 33	3620	PowerShell.exe
Token: 34	3620	PowerShell.exe
Token: 35	3620	PowerShell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4536	3620	PowerShell.exe	90
PID 4536 wrote to memory of 3372	4536	csc.exe	91
PID 3620 wrote to memory of 1380	3620	PowerShell.exe	92
PID 3620 wrote to memory of 3452	3620	PowerShell.exe	95
PID 3620 wrote to memory of 4380	3620	PowerShell.exe	98
PID 600 wrote to memory of 1600	600	userinit.exe	101
PID 3620 wrote to memory of 3852	3620	PowerShell.exe	104

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Modifies WinLogon for persistence
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmiinz03\hmiinz03.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES863D.tmp" "c:\Users\Admin\AppData\Local\Temp\hmiinz03\CSCD7BB90C6848C4394ADDBC55655CA5E65.TMP"
    3⤵
    PID:3372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\system32\vssadmin.exe
  "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3452
- C:\Windows\System32\Wbem\WMIC.exe
  "C:\Windows\System32\Wbem\WMIC.exe" shadowcopy delete
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Windows\system32\mshta.exe
  "C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\\darkside_lock.html"
  2⤵
  PID:3852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5808

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "while($true){Start-Sleep -Seconds 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 91b2176e162999356c0438d9fa66eb550c55dd4c1b44af5c9862634fa605257b
MD5 e2288ac603ea2069842675b57dc35b49
SHA1 74fe8bf094c556124d7d2ba7d6dbcaeb100b740c
SHA512 0ca8b94ea7052746617eca1c7b02237276ddc89b524e08a14002b1fafdec35ecaa95b062f6b356421c09a569f98c5d66faabd2b6208876f7c4279c709574ad4a
SSDEEP 1536:AKLg07Yo2hk3MFfKQVAflJdpCUp9YLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2P:AKLg07Yo2hk3MFfKQVAflJd0Up9YLqiP
TLSH
T17E637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RES863D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES863D.tmp
Size 1KB
SHA256 074b5a607cf7e12c753f6f3cc3955c32c3a3cf23760420d6760fef42cf059c72
MD5 2c3c91604c1bb6271a5309d285ddc11b
SHA1 8fee2fe2027eebe80db8b19cbbce1c0cedacaa59
SHA512 35e3d0ea8607e0c9466cd6c0fb922db0ea50213957b0e6c7fbebb83e56e3baa0689f530dc226e950d43bc8cc05b0ca2ed1b2d58156ada2c2ab5141b84333a734
TLSH
T1E8218C0693EC471EF0B34731A9F5172F9234FD95EF62675A4940022D1C91648DFE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2iaosbov.n3n.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2iaosbov.n3n.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

darkside_lock.html

Path C:\Users\Admin\AppData\Local\Temp\darkside_lock.html
Size 4KB
SHA256 8805cce9f86cb6b01053c295490c99dca0fa56573adb8ccf85715ca8d2ad80fd
MD5 f5b51efd5c9c6b190b10ede4f8923e3d
SHA1 636829140523bc4120a63e954c495de452bf1612
SHA512 c528e290ee73273211c7a7f7f0aef26c0c245508de4c054fea466d5bd3b751e9ee49ff99edb12350c7dda3fc0bc7301aedf94f699d33178df95b6d92887c56e5
SSDEEP 96:fZ7/nFNprgGPyFV35/k3XIisi+TDvki/Q+ir7U2CD8c:fZzXprgGPyFVJ/k3Yisi+vki9iPCAc
TLSH
T1F3A1A667681218166377EB6AAB73C789F134101314030F6CFD9C61A1CFBAD2246A3FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hmiinz03.dll

Path C:\Users\Admin\AppData\Local\Temp\hmiinz03\hmiinz03.dll
Size 3KB
SHA256 75ac8f497b76eec3c549eeef5d6889f0a769d88446347029b86af80064fbff87
MD5 5d8ba4a6b13068ebebe2eaf8e506cb08
SHA1 7e15e1eb554410e7cef2edd88f1a88808d8ea3f2
SHA512 0dcfe3d0f56346e13c9e620b1c61b37e6de5fb7db402f75143b23b8ce8f549be8f85a04317f4ca3bc4d96a12fe817f4b5766d5563560a0ec34ec8cf65fe8193a
TLSH
T15351DC1BA3E8466BE0A707306EE3432727B8FC549FB3536E4880022CAC613585E31FB4
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD7BB90C6848C4394ADDBC55655CA5E65.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hmiinz03\CSCD7BB90C6848C4394ADDBC55655CA5E65.TMP
Size 652B
SHA256 63a9b0d93d41a4b5535106ed91c909ca86fa69e3dac55943bf8715228e2fa0ce
MD5 52d5dce39e311b36be2ef11c254b7287
SHA1 d0006ffd8357897792c6a314d0c16ac76e6afcc3
SHA512 9022decfe09aca3746f3305fa9317337e2a797960475247d1b70eb75c6faa6fa73a72627d4523e98c4a46bb9d2add080a237c1a0c0030fd79d6f07cb853623a9
TLSH
T14CF05E0A63F8030EF0F34B30BDF6436391A8BC65DF3293ED1840035D28645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

hmiinz03.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hmiinz03\hmiinz03.0.cs
Size 170B
SHA256 55bb19b58f1e8cc33b461847e8079a910251e4e66e4ec6a22f4ec2bc1b308408
MD5 7c3b8651a72b2201b6cb4e9e4cab04ec
SHA1 cda010b1c8c58a8d8b20ee6bb77c46a6fafc0f21
SHA512 3bc0062442cafd277bbdaea4a1eb4a56c34c219b3f508cb3d6ec33a8b8c43c9f79f0ef618f4194d8d76fe51d16fa75982075372e626702071d4a32817b942b54
TLSH
T12FC080257E576AF600024D170C42F0FD77B711742667251596D55310FF4E00D4130A55
MD5 SHA1 SHA512 TLSH

Submit Download

hmiinz03.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hmiinz03\hmiinz03.cmdline
Size 369B
SHA256 60e4f7949a89a6815d0c75522af669f33016dcb136ffb7c5d324921b7c57bb27
MD5 7138e2f157357de2c21a2e7a711fb10e
SHA1 fd3cda16294988fabd395f00ed85a059a16c8ef6
SHA512 d851ad306cba042d061de40204a98b24e8f296b20f0ad58a55664562011dd52b0e7c9859135126b43c8c32c701bc3a5590cf12fb673a14c7d529044ca22efb13
TLSH
T1DFE0C63A424BC3FD21ED120B276AC4ACC3720783299B3F84A040840DE36B7282FD2789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1380-55-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-91-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-58-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-59-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-39-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-46-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-45-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-44-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-43-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-42-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-41-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-93-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/1380-40-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-22-0x0000020A42F90000-0x0000020A42F98000-memory.dmp

Download

memory/3620-18-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-38-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-37-0x0000020A430D0000-0x0000020A430DA000-memory.dmp

Download

memory/3620-35-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-33-0x0000020A42FF0000-0x0000020A4300E000-memory.dmp

Download

memory/3620-34-0x0000020A43010000-0x0000020A430C2000-memory.dmp

Download

memory/3620-30-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-29-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-28-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-25-0x0000020A436E0000-0x0000020A438EA000-memory.dmp

Download

memory/3620-24-0x0000020A43350000-0x0000020A434C6000-memory.dmp

Download

memory/3620-23-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-36-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-0-0x00007FFB7C5AF000-0x00007FFB7C5B0000-memory.dmp

Download

memory/3620-8-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-60-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-61-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-81-0x0000020A44010000-0x0000020A441D2000-memory.dmp

Download

memory/3620-82-0x0000020A44710000-0x0000020A44C38000-memory.dmp

Download

memory/3620-7-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-6-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-89-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-90-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-5-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-92-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download

memory/3620-3-0x0000020A2ABD0000-0x0000020A2ABF2000-memory.dmp

Download

memory/3620-4-0x00007FFB7C420000-0x00007FFB7CDC4000-memory.dmp

Download