overlord | 774922d2caacaf4628ed9a9938d6212f4c38a82d4f9b577b3aeb0066046caeef

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 13.0MB
Sample261109-cn5dpas16j
SHA256 774922d2caacaf4628ed9a9938d6212f4c38a82d4f9b577b3aeb0066046caeef
MD5 69ee97aa10e34bbd63a4a21ed6418d97
SHA1 347b1762c61bd856dccc240d09270d34d676a664
SHA512 3ba7358c8aa32e0617dd9975a96ffba56d951c9121c69187a3ec346dccb0ffc8afa993e4a976bac95a6e6642564110b032a0e46e7cd4e9499a08f866141e4f3e
SSDEEP 98304:vh+mVgVyJyc4IPU5g4krjsXn6wctnPODwVea7s16sf7E:v72kookvkfsanPODwv
TLSH
T1C3D63807FD6914E9C5AEC130C97292167BB17C994B2423D72B50B6287F76BE0AEBD310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution overlord persistence privilege_escalation rat

Malware Config

Extracted

Family

overlord

overlord.soft-beam.boxd.sh

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4eb-3.dat	family_overlord

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4eb-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2476	powershell.exe
5960	powershell.exe
2452	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4136	netsh.exe
2032	netsh.exe
2252	netsh.exe
5752	netsh.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-352541407.tmp	2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-3347186826.tmp	ovd_7588ec45d6f1.exe

Executes dropped EXE 1 IoCs

pid	Process
1524	ovd_7588ec45d6f1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-cf5d22f8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_7588ec45d6f1.exe\""	2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\OverlordAgent-cf5d22f8 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DeviceSync\\ovd_7588ec45d6f1.exe\""	ovd_7588ec45d6f1.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
9	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ovd_7588ec45d6f1.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ovd_7588ec45d6f1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ovd_7588ec45d6f1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ovd_7588ec45d6f1.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2476	powershell.exe
2476	powershell.exe
2476	powershell.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
2452	powershell.exe
2452	powershell.exe
2452	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeIncreaseQuotaPrivilege	5960	powershell.exe
Token: SeSecurityPrivilege	5960	powershell.exe
Token: SeTakeOwnershipPrivilege	5960	powershell.exe
Token: SeLoadDriverPrivilege	5960	powershell.exe
Token: SeSystemProfilePrivilege	5960	powershell.exe
Token: SeSystemtimePrivilege	5960	powershell.exe
Token: SeProfSingleProcessPrivilege	5960	powershell.exe
Token: SeIncBasePriorityPrivilege	5960	powershell.exe
Token: SeCreatePagefilePrivilege	5960	powershell.exe
Token: SeBackupPrivilege	5960	powershell.exe
Token: SeRestorePrivilege	5960	powershell.exe
Token: SeShutdownPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeSystemEnvironmentPrivilege	5960	powershell.exe
Token: SeRemoteShutdownPrivilege	5960	powershell.exe
Token: SeUndockPrivilege	5960	powershell.exe
Token: SeManageVolumePrivilege	5960	powershell.exe
Token: 33	5960	powershell.exe
Token: 34	5960	powershell.exe
Token: 35	5960	powershell.exe
Token: 36	5960	powershell.exe
Token: SeIncreaseQuotaPrivilege	2476	powershell.exe
Token: SeSecurityPrivilege	2476	powershell.exe
Token: SeTakeOwnershipPrivilege	2476	powershell.exe
Token: SeLoadDriverPrivilege	2476	powershell.exe
Token: SeSystemProfilePrivilege	2476	powershell.exe
Token: SeSystemtimePrivilege	2476	powershell.exe
Token: SeProfSingleProcessPrivilege	2476	powershell.exe
Token: SeIncBasePriorityPrivilege	2476	powershell.exe
Token: SeCreatePagefilePrivilege	2476	powershell.exe
Token: SeBackupPrivilege	2476	powershell.exe
Token: SeRestorePrivilege	2476	powershell.exe
Token: SeShutdownPrivilege	2476	powershell.exe
Token: SeDebugPrivilege	2476	powershell.exe
Token: SeSystemEnvironmentPrivilege	2476	powershell.exe
Token: SeRemoteShutdownPrivilege	2476	powershell.exe
Token: SeUndockPrivilege	2476	powershell.exe
Token: SeManageVolumePrivilege	2476	powershell.exe
Token: 33	2476	powershell.exe
Token: 34	2476	powershell.exe
Token: 35	2476	powershell.exe
Token: 36	2476	powershell.exe
Token: SeIncreaseQuotaPrivilege	5960	powershell.exe
Token: SeSecurityPrivilege	5960	powershell.exe
Token: SeTakeOwnershipPrivilege	5960	powershell.exe
Token: SeLoadDriverPrivilege	5960	powershell.exe
Token: SeSystemProfilePrivilege	5960	powershell.exe
Token: SeSystemtimePrivilege	5960	powershell.exe
Token: SeProfSingleProcessPrivilege	5960	powershell.exe
Token: SeIncBasePriorityPrivilege	5960	powershell.exe
Token: SeCreatePagefilePrivilege	5960	powershell.exe
Token: SeBackupPrivilege	5960	powershell.exe
Token: SeRestorePrivilege	5960	powershell.exe
Token: SeShutdownPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeSystemEnvironmentPrivilege	5960	powershell.exe
Token: SeRemoteShutdownPrivilege	5960	powershell.exe
Token: SeUndockPrivilege	5960	powershell.exe
Token: SeManageVolumePrivilege	5960	powershell.exe
Token: 33	5960	powershell.exe
Token: 34	5960	powershell.exe
Token: 35	5960	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5752	4716	2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 4716 wrote to memory of 2476	4716	2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	92
PID 4716 wrote to memory of 4136	4716	2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	94
PID 1524 wrote to memory of 2032	1524	ovd_7588ec45d6f1.exe	97
PID 1524 wrote to memory of 5960	1524	ovd_7588ec45d6f1.exe	99
PID 1524 wrote to memory of 2252	1524	ovd_7588ec45d6f1.exe	101
PID 1524 wrote to memory of 2452	1524	ovd_7588ec45d6f1.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe program=C:\Users\Admin\AppData\Local\Temp\2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_9598e755' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4136

C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe"
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall delete rule name=ovd_7588ec45d6f1.exe program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'ovd_9598e755' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name=ovd_7588ec45d6f1.exe dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$f = ([wmiclass]\"\\.\root\subscription:__EventFilter\").CreateInstance(); $f.QueryLanguage = 'WQL'; $f.Query = \"SELECT * FROM __InstanceCreationEvent WITHIN 30 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'explorer.exe'\"; $f.Name = 'ovd_f9598e755'; $f.EventNameSpace = 'root\cimv2'; $null = $f.Put(); $c = ([wmiclass]\"\\.\root\subscription:CommandLineEventConsumer\").CreateInstance(); $c.Name = 'ovd_c9598e755'; $c.ExecutablePath = 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\ovd_7588ec45d6f1.exe'; $null = $c.Put(); $b = ([wmiclass]\"\\.\root\subscription:__FilterToConsumerBinding\").CreateInstance(); $b.Filter = \"\\.\root\subscription:__EventFilter.Name='ovd_f9598e755'\"; $b.Consumer = \"\\.\root\subscription:CommandLineEventConsumer.Name='ovd_c9598e755'\"; $null = $b.Put()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
MD5 8c274452b4cefabecd528a1214159e4a
SHA1 59fefbf3c332bed6d778918035ad778fc2d3cad5
SHA512 9bd08a264f82cf86abb106e99d71e24f4c93aac148ef207091e370f242e49fef2bdff11fb29d20b1b6e1001ccf746a6191f571e33772e0eedbd54b1ed1aa3102
TLSH
T1B0217633B3CC8654C899013A10CEAC1036BB87CB409E8E9B6B84D519A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3aymbs2s.ezk.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3aymbs2s.ezk.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

agent-352541407.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\agent-352541407.tmp
Size 13.0MB
SHA256 774922d2caacaf4628ed9a9938d6212f4c38a82d4f9b577b3aeb0066046caeef
MD5 69ee97aa10e34bbd63a4a21ed6418d97
SHA1 347b1762c61bd856dccc240d09270d34d676a664
SHA512 3ba7358c8aa32e0617dd9975a96ffba56d951c9121c69187a3ec346dccb0ffc8afa993e4a976bac95a6e6642564110b032a0e46e7cd4e9499a08f866141e4f3e
SSDEEP 98304:vh+mVgVyJyc4IPU5g4krjsXn6wctnPODwVea7s16sf7E:v72kookvkfsanPODwv
TLSH
T1C3D63807FD6914E9C5AEC130C97292167BB17C994B2423D72B50B6287F76BE0AEBD310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-22-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-27-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-15-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-16-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-19-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-20-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-21-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-11-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-26-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-14-0x000001A0B7850000-0x000001A0B7872000-memory.dmp

Download

memory/2476-28-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-29-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-30-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-10-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-46-0x00007FF9CBA30000-0x00007FF9CC3D4000-memory.dmp

Download

memory/2476-9-0x00007FF9CBBBF000-0x00007FF9CBBC0000-memory.dmp

Download

memory/5960-41-0x0000025626C90000-0x0000025626C9A000-memory.dmp

Download

memory/5960-42-0x0000025627200000-0x000002562721E000-memory.dmp

Download

memory/5960-37-0x0000025626EB0000-0x0000025626ECE000-memory.dmp

Download

memory/5960-38-0x0000025626ED0000-0x0000025626F82000-memory.dmp

Download