15246ea17760cd4adf96629a48c2982b36bc3b1614534fd9721504ecfaf9231f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lol.exe
Size 319KB
Sample260531-pyc4eagx9t
SHA256 15246ea17760cd4adf96629a48c2982b36bc3b1614534fd9721504ecfaf9231f
MD5 ffc2a390cb39163d40f472ee87a973e4
SHA1 2a8f4a8e96726bbfcc35d309d2135720a5bf5c9a
SHA512 9b63a4a30e4350b1f06a8a98dd8673e374adb4091ef2cb000db127aa8ad0f68035f8a1602fed62a013ec4fee2fa5f02f59c07d65ebe9ab1153cefb25c174aa1d
SSDEEP 6144:8S7gI5V9dMbpvfSgMQ9zewb+hpHy7UBx:395fd2SgL96k+hpHyK
TLSH
T1AC640707F35360EDC42AC1748BABA233B932BC2E52306E2A5790DB753E55E50667DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4256	powershell.exe
1460	powershell.exe
3880	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
4764	TaskWorkerHelper.exe
2536	TaskWorkerHelper.exe
5208	TaskWorkerHelper.exe
1760	TaskWorkerHelper.exe
4616	TaskWorkerHelper.exe
4276	TaskWorkerHelper.exe
4664	TaskWorkerHelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDefSvc = "C:\\Users\\Admin\\AppData\\Roaming\\TaskWorkerHelper.exe"	reg.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3168	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2864	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3880	powershell.exe
3880	powershell.exe
4256	powershell.exe
4256	powershell.exe
1460	powershell.exe
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeIncreaseQuotaPrivilege	3880	powershell.exe
Token: SeSecurityPrivilege	3880	powershell.exe
Token: SeTakeOwnershipPrivilege	3880	powershell.exe
Token: SeLoadDriverPrivilege	3880	powershell.exe
Token: SeSystemProfilePrivilege	3880	powershell.exe
Token: SeSystemtimePrivilege	3880	powershell.exe
Token: SeProfSingleProcessPrivilege	3880	powershell.exe
Token: SeIncBasePriorityPrivilege	3880	powershell.exe
Token: SeCreatePagefilePrivilege	3880	powershell.exe
Token: SeBackupPrivilege	3880	powershell.exe
Token: SeRestorePrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeSystemEnvironmentPrivilege	3880	powershell.exe
Token: SeRemoteShutdownPrivilege	3880	powershell.exe
Token: SeUndockPrivilege	3880	powershell.exe
Token: SeManageVolumePrivilege	3880	powershell.exe
Token: 33	3880	powershell.exe
Token: 34	3880	powershell.exe
Token: 35	3880	powershell.exe
Token: 36	3880	powershell.exe
Token: SeIncreaseQuotaPrivilege	3880	powershell.exe
Token: SeSecurityPrivilege	3880	powershell.exe
Token: SeTakeOwnershipPrivilege	3880	powershell.exe
Token: SeLoadDriverPrivilege	3880	powershell.exe
Token: SeSystemProfilePrivilege	3880	powershell.exe
Token: SeSystemtimePrivilege	3880	powershell.exe
Token: SeProfSingleProcessPrivilege	3880	powershell.exe
Token: SeIncBasePriorityPrivilege	3880	powershell.exe
Token: SeCreatePagefilePrivilege	3880	powershell.exe
Token: SeBackupPrivilege	3880	powershell.exe
Token: SeRestorePrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeSystemEnvironmentPrivilege	3880	powershell.exe
Token: SeRemoteShutdownPrivilege	3880	powershell.exe
Token: SeUndockPrivilege	3880	powershell.exe
Token: SeManageVolumePrivilege	3880	powershell.exe
Token: 33	3880	powershell.exe
Token: 34	3880	powershell.exe
Token: 35	3880	powershell.exe
Token: 36	3880	powershell.exe
Token: SeIncreaseQuotaPrivilege	3880	powershell.exe
Token: SeSecurityPrivilege	3880	powershell.exe
Token: SeTakeOwnershipPrivilege	3880	powershell.exe
Token: SeLoadDriverPrivilege	3880	powershell.exe
Token: SeSystemProfilePrivilege	3880	powershell.exe
Token: SeSystemtimePrivilege	3880	powershell.exe
Token: SeProfSingleProcessPrivilege	3880	powershell.exe
Token: SeIncBasePriorityPrivilege	3880	powershell.exe
Token: SeCreatePagefilePrivilege	3880	powershell.exe
Token: SeBackupPrivilege	3880	powershell.exe
Token: SeRestorePrivilege	3880	powershell.exe
Token: SeShutdownPrivilege	3880	powershell.exe
Token: SeDebugPrivilege	3880	powershell.exe
Token: SeSystemEnvironmentPrivilege	3880	powershell.exe
Token: SeRemoteShutdownPrivilege	3880	powershell.exe
Token: SeUndockPrivilege	3880	powershell.exe
Token: SeManageVolumePrivilege	3880	powershell.exe
Token: 33	3880	powershell.exe
Token: 34	3880	powershell.exe
Token: 35	3880	powershell.exe
Token: 36	3880	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 4764	6116	lol.exe	81
PID 4764 wrote to memory of 2536	4764	TaskWorkerHelper.exe	82
PID 4764 wrote to memory of 4768	4764	TaskWorkerHelper.exe	83
PID 4768 wrote to memory of 4864	4768	cmd.exe	85
PID 4768 wrote to memory of 3880	4768	cmd.exe	86
PID 4764 wrote to memory of 5960	4764	TaskWorkerHelper.exe	88
PID 5960 wrote to memory of 6084	5960	cmd.exe	90
PID 5960 wrote to memory of 2852	5960	cmd.exe	91
PID 4764 wrote to memory of 2872	4764	TaskWorkerHelper.exe	92
PID 2872 wrote to memory of 4540	2872	cmd.exe	94
PID 2872 wrote to memory of 2864	2872	cmd.exe	95
PID 4764 wrote to memory of 3168	4764	TaskWorkerHelper.exe	96
PID 3168 wrote to memory of 5984	3168	cmd.exe	98
PID 3168 wrote to memory of 4268	3168	cmd.exe	99
PID 4764 wrote to memory of 772	4764	TaskWorkerHelper.exe	104
PID 772 wrote to memory of 4448	772	cmd.exe	106
PID 772 wrote to memory of 4256	772	cmd.exe	107
PID 4764 wrote to memory of 3732	4764	TaskWorkerHelper.exe	108
PID 3732 wrote to memory of 3388	3732	cmd.exe	110
PID 3732 wrote to memory of 1460	3732	cmd.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4268	attrib.exe

C:\Users\Admin\AppData\Local\Temp\lol.exe
"C:\Users\Admin\AppData\Local\Temp\lol.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe" --r
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe" --wd 4764
    3⤵
    - Executes dropped EXE
    PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\TaskWorkerMonitor' -Action $a -Trigger $t -Settings $s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -W Hidden -C "$a=New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe';$t=New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2);$s=New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit 0;Register-ScheduledTask -Force -TaskName '\Microsoft\Windows\Maintenance\TaskWorkerMonitor' -Action $a -Trigger $t -Settings $s"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3880
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && schtasks /create /f /sc minute /mo 1 /tn "TaskWorkerHelper" /tr "\"C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe\""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:6084
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "TaskWorkerHelper" /tr "\"C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe\""
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2852
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDefSvc /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4540
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinDefSvc /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2864
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5984
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe"
      4⤵
      Views/modifies file attributes
      PID:4268
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4256
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c chcp 65001 >nul && powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_cam_find.ps1
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\mc_cam_find.ps1
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1460

C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
"C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe"
1⤵
- Executes dropped EXE
PID:5208

C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
1⤵
- Executes dropped EXE
PID:1760

C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
C:\Users\Admin\AppData\Roaming\TaskWorkerHelper.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe
1⤵
- Executes dropped EXE
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 91dd8682bdce1321d453d777baac5a9f94165dabce301c3554a52fb82d9a836d
MD5 261b4cc37701b1779e2e290c38facbae
SHA1 064615e556437ca4248930f14ee6ec27f64f3672
SHA512 e34ac14a99c033de9941a8ef0271b98e4fb74c2608b18642a515bc53e105fde4370f50b4401a6a7345fe52640554273352c25059f0888ad73acc1e0bf2e4929e
TLSH
T1E481CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 10f7d2288fefb1efd6351733299453b7dffc867e0727f7b918d7def87801f3b5
MD5 86deb57401ced067b2249c3b5a69a596
SHA1 78a7717aaae459ed751255bf6dbfe4dfbed1ea87
SHA512 9b5196485bcb4ee50c0c29c59892707a07e70cedf6a119dbf9c5f248f6ae7a42567f8d8ec700841d01789c8b94d6c7d1afce19dce3a056759cb368b15d9a55cc
TLSH
T1CC216533B3ECC125C8D9117A208CAD01B2B5C3CB449ECF8B6A84C619997F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eb00507966b97e3ab5919ff3bbbd3e026f748241a55aeac4243350ff7fbb5aaa
MD5 41cb8b92a27e0c666e4617ca615fd409
SHA1 fa616fd83d0271487f2dfe92e11dc75fea4e79ce
SHA512 395cf450b45de29e635b0d04f54dc12359df58243a19dc11a4193d185984cc9ea3d77eacf76940e4c1712c6e8aafd34c81bfb6a62a94684683954d5e69523c9b
TLSH
T14121AC33B3ECC125C8D9117A209CAD0072B5C3C744DECF8B6B84C219957F5D9DB541A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_npq0hlyw.y4h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npq0hlyw.y4h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mc_cam_find.ps1

Path C:\Users\Admin\AppData\Local\Temp\mc_cam_find.ps1
Size 442B
SHA256 552649ff15e4fd81fbf5bb69c747095c7040753449f33c57903c0bc72579d0c7
MD5 cc93266c37ed169f1f1d46f00a8ef63f
SHA1 e7006dacc8875fc918760b00a35e2db360e02236
SHA512 4eed0fdc601bba5330a6ddacb0789ed875058fd38d4bd6bdfca2e6d084c06b8ed2c7b546767552b3eddefac5230145692e3d4a99065a8005db8f978679766253
TLSH
T153F0DC40822D0EDBADC35334F94B6B21AFAA008E55113D0060FC9FB183104830C4A72F
MD5 SHA1 SHA512 TLSH

Submit Download

mc_lc.ps1

Path C:\Users\Admin\AppData\Local\Temp\mc_lc.ps1
Size 773B
SHA256 90c2ec35850528fd459078e552a49e902b035fbc8f6d877071f25f28d5da52a9
MD5 767478346d3de0810f254ca5ca9525aa
SHA1 c9988232a121e630ca0f840dc9613e835ba870f6
SHA512 d686db10c79f62bd9821ee56040ff8c3e0c12f6f8d30c17bc1dbb299377b9ed44b3ac8a68a10405c34f14e40dd3123ff911801400b1dcc25d83b7e685ccad6a1
TLSH
T121012000526D4ADB7DD343BAFB4BA7277F8E004D5B152A40D5FC6F92B300E870A5AA5E
MD5 SHA1 SHA512 TLSH

Submit Download

TaskWorkerHelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\TaskWorkerHelper.exe
Size 319KB
SHA256 15246ea17760cd4adf96629a48c2982b36bc3b1614534fd9721504ecfaf9231f
MD5 ffc2a390cb39163d40f472ee87a973e4
SHA1 2a8f4a8e96726bbfcc35d309d2135720a5bf5c9a
SHA512 9b63a4a30e4350b1f06a8a98dd8673e374adb4091ef2cb000db127aa8ad0f68035f8a1602fed62a013ec4fee2fa5f02f59c07d65ebe9ab1153cefb25c174aa1d
SSDEEP 6144:8S7gI5V9dMbpvfSgMQ9zewb+hpHy7UBx:395fd2SgL96k+hpHyK
TLSH
T1AC640707F35360EDC42AC1748BABA233B932BC2E52306E2A5790DB753E55E50667DF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1460-84-0x000001CFA7BF0000-0x000001CFA7CA3000-memory.dmp

Download

memory/1760-38-0x00007FF647FA0000-0x00007FF64800D000-memory.dmp

Download

memory/2536-40-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/3880-23-0x000001BFCC080000-0x000001BFCC09C000-memory.dmp

Download

memory/3880-22-0x000001BFCC050000-0x000001BFCC05A000-memory.dmp

Download

memory/3880-20-0x000001BFCBF70000-0x000001BFCBF8C000-memory.dmp

Download

memory/3880-21-0x000001BFCBF90000-0x000001BFCC043000-memory.dmp

Download

memory/3880-12-0x000001BFCBCD0000-0x000001BFCBCF2000-memory.dmp

Download

memory/4256-67-0x000001BB7E400000-0x000001BB7E424000-memory.dmp

Download

memory/4256-65-0x000001BB1A5A0000-0x000001BB1A653000-memory.dmp

Download

memory/4256-66-0x000001BB7E400000-0x000001BB7E42A000-memory.dmp

Download

memory/4276-105-0x00007FF647FA0000-0x00007FF64800D000-memory.dmp

Download

memory/4616-88-0x00007FF647FA0000-0x00007FF64800D000-memory.dmp

Download

memory/4664-111-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/4764-47-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/4764-39-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/4764-89-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/4764-94-0x00007FF638CF0000-0x00007FF638D5D000-memory.dmp

Download

memory/5208-35-0x00007FF647FA0000-0x00007FF64800D000-memory.dmp

Download

memory/6116-13-0x00007FF6A4530000-0x00007FF6A459D000-memory.dmp

Download