Overview

overview

8

Static

static

3

2026-07-20...kn.exe

windows10-2004-x64

8

2026-07-20...kn.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 03:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_30644ea02ca6b744159805ffa36b700a_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
  • Size 7.9MB
  • Sample260720-dwecxagv61
  • SHA256 fe68d85dcd1521af33089281ebd465e7ee524384ccf00c760bfeeb392d1d05c6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs

    Run Powershell and hide display window.

    execution
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a command shell one-liner 1 TTPs 36 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_30644ea02ca6b744159805ffa36b700a_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_30644ea02ca6b744159805ffa36b700a_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:2644
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:612
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:244
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4172
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:3364
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4904
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:2840
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:1916
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3744
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4836
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:1652
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3548
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4728
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:956
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4756
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:3644
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3356
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:3040
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3948
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:5004
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4172
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3284
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4076
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:1120
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:3028
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:2960
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2324
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4716
    • C:\Windows\system32\cmd.exe
      cmd /C ver
      2⤵
      • Executes a command shell one-liner
      PID:736
    • C:\Windows\system32\cmd.exe
      cmd /C "wmic os get osarchitecture"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4332
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic os get osarchitecture
        3⤵
          PID:724
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5748
      • C:\Windows\system32\cmd.exe
        cmd /C ver
        2⤵
        • Executes a command shell one-liner
        PID:4264
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic os get osarchitecture"
        2⤵
        • Executes a command shell one-liner
        PID:2412
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get osarchitecture
          3⤵
            PID:2644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:952
        • C:\Windows\system32\cmd.exe
          cmd /C ver
          2⤵
          • Executes a command shell one-liner
          PID:2104
        • C:\Windows\system32\cmd.exe
          cmd /C "wmic os get osarchitecture"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4108
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic os get osarchitecture
            3⤵
              PID:2260
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1408
          • C:\Windows\system32\cmd.exe
            cmd /C ver
            2⤵
            • Executes a command shell one-liner
            PID:1512
          • C:\Windows\system32\cmd.exe
            cmd /C "wmic os get osarchitecture"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4244
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic os get osarchitecture
              3⤵
                PID:4400
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1028
            • C:\Windows\system32\cmd.exe
              cmd /C ver
              2⤵
              • Executes a command shell one-liner
              PID:200
            • C:\Windows\system32\cmd.exe
              cmd /C "wmic os get osarchitecture"
              2⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic os get osarchitecture
                3⤵
                  PID:4916
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:6108
              • C:\Windows\system32\cmd.exe
                cmd /C ver
                2⤵
                • Executes a command shell one-liner
                PID:5356
              • C:\Windows\system32\cmd.exe
                cmd /C "wmic os get osarchitecture"
                2⤵
                • Executes a command shell one-liner
                PID:2824
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic os get osarchitecture
                  3⤵
                    PID:1356
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5536
                • C:\Windows\system32\cmd.exe
                  cmd /C ver
                  2⤵
                  • Executes a command shell one-liner
                  PID:5500
                • C:\Windows\system32\cmd.exe
                  cmd /C "wmic os get osarchitecture"
                  2⤵
                  • Executes a command shell one-liner
                  PID:5944
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic os get osarchitecture
                    3⤵
                      PID:4800
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object displayName"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5464

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 483f8e3d65c9136df1aecc4550d4e40d5f6a80f929e19dfd4c1c368c26aa849b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 ec614a7c5ac7ec1982022267339782fc997db0fd9d1bac671aebdd9cf31da260
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 1d7487739c12b3ac6c0c9ede998c12c0a125de1c6021e3247206d20b129e6c2b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6ef7d14b1393f0c0f0119dc13746e0d1d585aecd34e7bf4af28952031917332b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 4f5a192ee7a093453ab6cd376ea03e565419e6274a42fbd78026e4eefe46b178
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3a9bfe2b4a24fa78b5237cfcf3a9828fe8b5699faa3cfb88fefca4523cb75a8c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 269bdc0f258f8a7efe116760e1e8005f46cf8bf350d8ab9a87a8423845c52352
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 750213c6a5ab570a10f38fa90eb44096bf105db437e11785e992de5694bc4cd1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 94d46bf6480771ff90c7dca5f3e32270a686b65728f0cd22130ea97516bbdda1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 6c2efdd5c67d60a91b752475d6703c16fcb1442e7e00c649974358130e9ce845
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f916075ccf4073a18383b78278ce7314465bfca8b1a3e536e423e33a8f791c16
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 c5a01de776896c39caf8c79280f92bd6db7cf5773592eeebdbbcf5ae04b0bb27
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 3276da8365d41717cabb2c0aba92ddee6507f46b49c2a00c0571a3f35f46ff3d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 922687d23d3066aafbb3572fb095d7a95562faffc0900ad083ec3684b397b735
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 f1f36ce6b96306efdb0b9b0fd82c259033ffb3042d02dbd1f416a59a1ee803a8
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 25d7e831bccd1d03fd027b8a7e8159bcc7e4062161f7f541052e5a635e4f4321
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_o4g0qwxr.mnf.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o4g0qwxr.mnf.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/612-15-0x0000025B5EA20000-0x0000025B5EA3E000-memory.dmp
                      Download

                      memory/612-19-0x0000025B5EA70000-0x0000025B5EA9A000-memory.dmp
                      Download

                      memory/612-0-0x00007FFCD4BFF000-0x00007FFCD4C00000-memory.dmp
                      Download

                      memory/612-18-0x0000025B5E9B0000-0x0000025B5E9BA000-memory.dmp
                      Download

                      memory/612-22-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-1-0x0000025B5E980000-0x0000025B5E9A2000-memory.dmp
                      Download

                      memory/612-16-0x0000025B5ECF0000-0x0000025B5EDA2000-memory.dmp
                      Download

                      memory/612-2-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-20-0x0000025B5EA70000-0x0000025B5EA94000-memory.dmp
                      Download

                      memory/612-12-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-24-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-17-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-9-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-11-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-10-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-5-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-23-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-8-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-7-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/612-6-0x00007FFCD4A70000-0x00007FFCD5414000-memory.dmp
                      Download

                      memory/1028-111-0x00000210E44F0000-0x00000210E45A2000-memory.dmp
                      Download

                      memory/2840-36-0x0000023D78490000-0x0000023D78542000-memory.dmp
                      Download

                      memory/4716-86-0x000001EDC34E0000-0x000001EDC3592000-memory.dmp
                      Download

                      memory/4836-43-0x0000015CDB270000-0x0000015CDB322000-memory.dmp
                      Download