Overview

overview

10

Static

static

10

2026-08-10...kn.exe

windows10-2004-x64

8

2026-08-10...kn.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 03:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_d7934e1f1f2b5cd1284c1e1469e80c26_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
  • Size 14.9MB
  • Sample260810-ehb63a1anc
  • SHA256 b28d0615aa9ef5f5a8e9bfcd578672d21cceb8cbec50fcce55bb833916b544d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
command_and_controldefense_evasiondiscoveryexecutionlateral_movementpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Outbound SSH connection to private host 3 TTPs 64 IoCs

    SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.

    command_and_controllateral_movement
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Discovers running processes 1 TTPs 12 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • System Network Connections Discovery 1 TTPs 1 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 6 IoCs

    Uses commandline utility to view network configuration.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 24 IoCs
    defense_evasion
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_d7934e1f1f2b5cd1284c1e1469e80c26_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d7934e1f1f2b5cd1284c1e1469e80c26_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
    1⤵
    • Outbound SSH connection to private host
    • Suspicious use of WriteProcessMemory
    PID:5800
    • C:\Windows\system32\tasklist.exe
      tasklist
      2⤵
      • Discovers running processes
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Network Configuration Discovery: Wi-Fi Discovery
      PID:2540
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-VpnConnection
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\system32\netsh.exe
      netsh wlan show interfaces
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:4832
    • C:\Windows\system32\tracert.exe
      tracert -d -h 5 8.8.8.8
      2⤵
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:2292
    • C:\Windows\system32\route.exe
      route print
      2⤵
        PID:4792
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        2⤵
        • Gathers network information
        PID:1420
      • C:\Windows\system32\netstat.exe
        netstat -ano
        2⤵
        • System Network Connections Discovery
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
      • C:\Windows\system32\netsh.exe
        netsh advfirewall show allprofiles
        2⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:6048
      • C:\Windows\system32\netstat.exe
        netstat -s
        2⤵
        • Gathers network information
        PID:6096
      • C:\Windows\system32\net.exe
        net share
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5368
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 share
          3⤵
            PID:248
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:1232
        • C:\Windows\system32\arp.exe
          arp -a 10.0.0.1
          2⤵
          • Network Service Discovery
          PID:948
        • C:\Windows\System32\Wbem\wmic.exe
          wmic share get name,path,status
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6116
        • C:\Windows\system32\netsh.exe
          netsh firewall show config
          2⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4992
        • C:\Windows\system32\rasdial.exe
          rasdial
          2⤵
            PID:4820
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq openvpn*"
            2⤵
            • Discovers running processes
            PID:6472
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-SmbShare
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:6584
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq wireguard*"
            2⤵
            • Discovers running processes
            PID:7744
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq protonvpn*"
            2⤵
            • Discovers running processes
            PID:7900
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq nordvpn*"
            2⤵
            • Discovers running processes
            PID:8088
          • C:\Windows\system32\tasklist.exe
            tasklist /FI "IMAGENAME eq expressvpn*"
            2⤵
            • Discovers running processes
            PID:8148
          • C:\Windows\system32\ipconfig.exe
            ipconfig /all
            2⤵
            • Gathers network information
            PID:7356
          • C:\Windows\System32\Wbem\wmic.exe
            wmic nic get name,index,netenabled
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:7208
          • C:\Windows\system32\arp.exe
            arp -a
            2⤵
            • Network Service Discovery
            PID:7432
          • C:\Windows\system32\ping.exe
            ping -n 1 -w 1000 10.127.0.1
            2⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:7804
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command " Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName System.Drawing $screen = [System.Windows.Forms.SystemInformation]::VirtualScreen $bitmap = New-Object System.Drawing.Bitmap $screen.Width, $screen.Height $graphics = [System.Drawing.Graphics]::FromImage($bitmap) $graphics.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size) $bitmap.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sys_scan_GB_1786334174\\screenshots\\screenshot1.png\", [System.Drawing.Imaging.ImageFormat]::Png) $graphics.Dispose() $bitmap.Dispose() "
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:7904
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject Win32_VideoController | Select-Object Name"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:8180
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:6584
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject Win32_DiskDrive | Select-Object Size,Model"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:8132
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Get-WmiObject Win32_USBHub | Select-Object DeviceID"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:2980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Get-HotFix
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:7776
          • C:\Windows\system32\net.exe
            net user
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:7920
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 user
              3⤵
                PID:8116
            • C:\Windows\system32\netsh.exe
              netsh advfirewall show allprofiles
              2⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:7936
            • C:\Windows\system32\netsh.exe
              netsh wlan show interfaces
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:8144
            • C:\Windows\system32\ipconfig.exe
              ipconfig /all
              2⤵
              • Gathers network information
              PID:7668
            • C:\Windows\system32\netstat.exe
              netstat -e
              2⤵
              • Gathers network information
              PID:6516
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell Get-ChildItem $env:USERPROFILE\Recent | Select-Object Name | Format-Table -AutoSize
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3748
            • C:\Windows\system32\wevtutil.exe
              wevtutil qe System /c:10 /rd:true /f:text
              2⤵
                PID:3568
              • C:\Windows\system32\schtasks.exe
                schtasks /query /fo LIST
                2⤵
                  PID:7900
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM chrome.exe
                  2⤵
                  • Kills process with taskkill
                  PID:7188
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM msedge.exe
                  2⤵
                  • Kills process with taskkill
                  PID:7220
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM firefox.exe
                  2⤵
                  • Kills process with taskkill
                  PID:6476
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM iexplore.exe
                  2⤵
                  • Kills process with taskkill
                  PID:7308
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM chromium.exe
                  2⤵
                  • Kills process with taskkill
                  PID:7432
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM opera.exe
                  2⤵
                  • Kills process with taskkill
                  PID:7952
                • C:\Windows\system32\taskkill.exe
                  taskkill /IM brave.exe
                  2⤵
                  • Kills process with taskkill
                  PID:8092
                  • C:\Windows\System32\Conhost.exe
                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    3⤵
                      PID:7904
                  • C:\Windows\system32\taskkill.exe
                    taskkill /IM vivaldi.exe
                    2⤵
                    • Kills process with taskkill
                    PID:8000
                  • C:\Windows\system32\taskkill.exe
                    taskkill /IM waterfox.exe
                    2⤵
                    • Kills process with taskkill
                    PID:7360
                  • C:\Windows\system32\taskkill.exe
                    taskkill /IM palemoon.exe
                    2⤵
                    • Kills process with taskkill
                    PID:7368
                  • C:\Windows\system32\taskkill.exe
                    taskkill /IM seamonkey.exe
                    2⤵
                    • Kills process with taskkill
                    PID:7784
                  • C:\Windows\system32\taskkill.exe
                    taskkill /IM thunderbird.exe
                    2⤵
                    • Kills process with taskkill
                    PID:7432
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:7804
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM chrome.exe
                      2⤵
                      • Kills process with taskkill
                      PID:8168
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        3⤵
                          PID:7952
                      • C:\Windows\system32\taskkill.exe
                        taskkill /F /IM msedge.exe
                        2⤵
                        • Kills process with taskkill
                        PID:5212
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:8116
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM firefox.exe
                          2⤵
                          • Kills process with taskkill
                          PID:7932
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM iexplore.exe
                          2⤵
                          • Kills process with taskkill
                          PID:7360
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM chromium.exe
                          2⤵
                          • Kills process with taskkill
                          PID:8100
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM opera.exe
                          2⤵
                          • Kills process with taskkill
                          PID:8164
                        • C:\Windows\system32\taskkill.exe
                          taskkill /F /IM brave.exe
                          2⤵
                          • Kills process with taskkill
                          PID:8128
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            3⤵
                              PID:8180
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM vivaldi.exe
                            2⤵
                            • Kills process with taskkill
                            PID:8112
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM waterfox.exe
                            2⤵
                            • Kills process with taskkill
                            PID:7268
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM palemoon.exe
                            2⤵
                            • Kills process with taskkill
                            PID:7468
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM seamonkey.exe
                            2⤵
                            • Kills process with taskkill
                            PID:3568
                          • C:\Windows\system32\taskkill.exe
                            taskkill /F /IM thunderbird.exe
                            2⤵
                            • Kills process with taskkill
                            PID:7368
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq chrome.exe"
                            2⤵
                            • Discovers running processes
                            PID:7204
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq msedge.exe"
                            2⤵
                            • Discovers running processes
                            PID:2852
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq firefox.exe"
                            2⤵
                            • Discovers running processes
                            PID:7808
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq opera.exe"
                            2⤵
                            • Discovers running processes
                            PID:7248
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              3⤵
                                PID:7188
                            • C:\Windows\system32\tasklist.exe
                              tasklist /FI "IMAGENAME eq brave.exe"
                              2⤵
                              • Discovers running processes
                              PID:7360
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:6476
                              • C:\Windows\system32\tasklist.exe
                                tasklist /FI "IMAGENAME eq vivaldi.exe"
                                2⤵
                                • Discovers running processes
                                PID:7668
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  3⤵
                                    PID:7208

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    2
                                    T1059

                                    PowerShell

                                    1
                                    T1059.001

                                    Persistence

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Privilege Escalation

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Defense Evasion

                                    Impair Defenses

                                    1
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    1
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Discovery

                                    Browser Information Discovery

                                    1
                                    T1217

                                    Network Service Discovery

                                    3
                                    T1046

                                    Network Share Discovery

                                    1
                                    T1135

                                    Process Discovery

                                    1
                                    T1057

                                    Query Registry

                                    2
                                    T1012

                                    Remote System Discovery

                                    1
                                    T1018

                                    System Information Discovery

                                    1
                                    T1082

                                    System Network Configuration Discovery

                                    3
                                    T1016

                                    Internet Connection Discovery

                                    2
                                    T1016.001

                                    Wi-Fi Discovery

                                    1
                                    T1016.002

                                    System Network Connections Discovery

                                    1
                                    T1049

                                    Lateral Movement

                                    Remote Services

                                    1
                                    T1021

                                    SSH

                                    1
                                    T1021.004

                                    Collection

                                    Data from Local System

                                    1
                                    T1005

                                    Command and Control

                                    Protocol Tunneling

                                    1
                                    T1572

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 3843b12ec68df316a9a7fffce861fbb368f45d315c2f700b1f587161974d2397
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 46a7b62f63a994730315f67564f547977c1e8c4dcdab3db51d4099c4742e74fa
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    StartupProfileData-NonInteractive
                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    • Size 1KB
                                    • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    __PSScriptPolicyTest_yf3ad4ko.xiv.ps1
                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yf3ad4ko.xiv.ps1
                                    • Size 60B
                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    screenshot1.png
                                    • Path C:\Users\Admin\AppData\Local\Temp\sys_scan_GB_1786334174\screenshots\screenshot1.png
                                    • Size 542KB
                                    • SHA256 95e7d553628780577d70fb89397965dda7c1773eb93238af12f6b47445738b3f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/2720-3-0x0000012377DB0000-0x0000012377DD2000-memory.dmp
                                    Download

                                    memory/2720-7-0x00000123781B0000-0x0000012378262000-memory.dmp
                                    Download

                                    memory/2720-9-0x0000012377E60000-0x0000012377E6A000-memory.dmp
                                    Download

                                    memory/2720-6-0x0000012377E30000-0x0000012377E4E000-memory.dmp
                                    Download

                                    memory/2720-12-0x00000123783E0000-0x00000123783FC000-memory.dmp
                                    Download

                                    memory/2720-11-0x0000012377E70000-0x0000012377E7A000-memory.dmp
                                    Download

                                    memory/2720-10-0x00000123783C0000-0x00000123783DE000-memory.dmp
                                    Download

                                    memory/6584-20-0x000001B530BA0000-0x000001B530C52000-memory.dmp
                                    Download

                                    memory/7904-29-0x000002BF80610000-0x000002BF807DA000-memory.dmp
                                    Download