Overview

overview

7

Static

static

3

2026-08-02...er.exe

windows10-2004-x64

7

2026-08-02...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 11:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe
  • Size 2.4MB
  • Sample260802-m87dwsyshw
  • SHA256 ed8fe2bc98aa221813594e5198b80fad07e0b71193e0266c0b9f1577b7707d2c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\USBMonitorSrv.exe
      /i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4128
    • C:\Users\Admin\AppData\Local\Temp\host.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:4396
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1984
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3388
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3740
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3932
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3464
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3336
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3448
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3408
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:4656
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3320
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:2200
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:2208
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3796
    • C:\Daemon.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-02_9a92452b3c9ec912127e53a77031261e_amadey_elex_remcos_smoke-loader.exe"
      2⤵
      • Executes dropped EXE
      PID:3716
  • C:\USBMonitorSrv.exe
    C:\USBMonitorSrv.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\yyzUSB.exe
      "C:\yyzUSB.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Windows\SysWOW64\host.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:2316
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3356
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:3476
      • C:\Daemon.exe
        "C:\yyzUSB.exe"
        3⤵
        • Executes dropped EXE
        PID:4260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Daemon.exe
        • Path C:\Daemon.exe
        • Size 454KB
        • SHA256 1d4a9e19b470570cf52676d3cad4dfb8880e7fba83df9a034792677c2f4c8e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.9MB
        • SHA256 f0fbd57aa73ff43ba560d108289a3e29ed19f780f4489ba409be9763a7ccff40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 2.1MB
        • SHA256 23f71ee206d0c51a23a6341f8a95233baa50c3d2a87026e916a18a8c5f8c0529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.7MB
        • SHA256 8210ba057e5220d0af061e72ed50d01a98a37fbc8802e7e876f674df23321083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.4MB
        • SHA256 71d5131ab9205ad2e279a3f0cd58892661a8ebb96c509be3bf843562c18d90ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.2MB
        • SHA256 f16b3cdba8a83b01c0b619bdfd80ec64dca1dd7f4dccb53f5a0ff30f3ca58a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.6MB
        • SHA256 1b9932a2f25a46d531cff7f0f2ad528c49352565e83f5c20bf285cd91d883fe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.8MB
        • SHA256 3c87a08fbc3d8f3bed4bb11dcf802b8bc95916145c1039f6ee908f9f08936791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 5.0MB
        • SHA256 8d5f84d12fd4ee67011dbe43f4fa9423e5b4ec45a3ffe442c107ff064a34b8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 2.2MB
        • SHA256 7981f9772f6202911a6ba7af1b38202b9bc7186c2cb5fdcc57d06c6277552bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 2.1MB
        • SHA256 a00da9c27c720e672eb3156be734dddda01f13fe50ab667dfa23a1b5d27bb57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 2.2MB
        • SHA256 28f44683ed30655b97a866f63784a39686cb0157a7bbd2cb1cf5e0ea11da977b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSPPREARM.EXE
        • Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
        • Size 2.2MB
        • SHA256 601f70624d6eca1e629f1d794646dcedf56a7fb90191792cddc78e943829003d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 2.2MB
        • SHA256 6df16de059d80c83b69b9f6cfabe3a7befeab7f847125b732319611824788336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 8.6MB
        • SHA256 5116ec8247c61220e6495a1592de02136b5cf152decb4f4ace88c0606400f216
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CLVIEW.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
        • Size 2.5MB
        • SHA256 228ec5f3dbc29da882a215866d5b1db4522f81659b8498b2a6e9de28cf5d42fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IEContentService.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe
        • Size 2.4MB
        • SHA256 67f5b9bd72d19bb697e129d9045b81e3f4fd7733c2be677c4ec96c65ccec0e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSOHTMED.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE
        • Size 2.5MB
        • SHA256 ca71938bb4556ea26ccd33a0a19c49c26c456d6eb04cf996cfa65f6327019a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSQRY32.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE
        • Size 2.8MB
        • SHA256 684c44ea341317052c7214923df7d7ce56f52390770d2b20b640eccb20f8853b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ONENOTEM.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
        • Size 2.1MB
        • SHA256 09b20301232e7edc4fba560bc4798aca78bc2fe7bd252140a51a6e6441357ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VPREVIEW.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE
        • Size 2.5MB
        • SHA256 37ac0593b672f585bc47eb50767602c8196c0d78e99fab9bebd10b884354bb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WINWORD.EXE
        • Path C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
        • Size 3.8MB
        • SHA256 0782ef2dc216f394020822fa4a43bbaa0077a7f7b37296f0a1aca055068bdd16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wordconv.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
        • Size 2.0MB
        • SHA256 3ab50bf4c8c622db5b576f59116f645363b383041fb1342121737c1ecb87f69d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        officeappguardwin32.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe
        • Size 2.5MB
        • SHA256 7684ea5277cfc508853d42887775ec1863ca7b337be0252831b4925ac02b1850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        default-browser-agent.exe
        • Path C:\Program Files\Mozilla Firefox\default-browser-agent.exe
        • Size 2.0MB
        • SHA256 2427afabf04464332bdba3eb7ee36259c40a4ae3970ed40b9be0d8463e9cdefb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        plugin-container.exe
        • Path C:\Program Files\Mozilla Firefox\plugin-container.exe
        • Size 2.1MB
        • SHA256 5452d48e7b7d7e6320c15e7e3b4ed5e842b88dbbd1abfda716480035fe1c8ef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 2.1MB
        • SHA256 bc47f858aa9820f8e81d6b5ddf14627929a3f16702462102154e44c6e7100afe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 2.0MB
        • SHA256 2a6e9fdfc054ff7cd902a01e40bad29976bc29a49ff138b1531d68c8b9afd6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        USBMonitorSrv.exe
        • Path C:\USBMonitorSrv.exe
        • Size 694KB
        • SHA256 f92c2d3b3f1df60b6401f697a05bd3e200a824a9aa2cc84a021963c911987c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX120D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX120D.tmp
        • Size 2.2MB
        • SHA256 5a57121d3ccece48ff894122c033fdb0084049046bd4633289520314987668f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX4A3B.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX4A3B.tmp
        • Size 6.1MB
        • SHA256 c83624be79c8c14f2b47b42f28c4faf0ac826befb45d2d7d8f5389f7eb7a1681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCX93CB.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCX93CB.tmp
        • Size 2.2MB
        • SHA256 86fe868f9d100211d299e6429375572aacfdb435f4cf5b72cde073c195d7037f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXD96.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXD96.tmp
        • Size 2.0MB
        • SHA256 a5e2fad692304006a7c2620c869bf9a879ee789ff49476f7b9fe5c2282da3e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXF2A0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXF2A0.tmp
        • Size 2.0MB
        • SHA256 d81e8e42489bb165fed073c58c4286831ce4b38b5601abd12ae4d161fa9d4580
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RCXF313.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\RCXF313.tmp
        • Size 2.0MB
        • SHA256 1afb0c7203b463dcc32ee85fe37653c6cd6b5448bfc1ecd06f73c7b521092720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host.exe
        • Path C:\Users\Admin\AppData\Local\Temp\host.exe
        • Size 450KB
        • SHA256 99244c76f9c483442fd488657a8677a8499df70458a0ef53f0fae0e0e3bc13ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.2MB
        • SHA256 3bcb09da8946e2d652ab0aa64601db5b62cb69076981e3b1b5d8e23b2efa67f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.1MB
        • SHA256 327645bb048545c9fbd5b6bc8f6345ed375fe00f4351513a191d9e287072b5d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.1MB
        • SHA256 0245663217e40d3a1e6a5daca94a96679defbcb1536415ebb52afb776764f938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 0214e4028bfb94af3916a2cc0894ffbc663f8ae0f22ef96008050338b5cdcf80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.9MB
        • SHA256 072645a6c8e30f13c4daf296eae0bfe67a5a5ee00892de82d4b215d6bffd2132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tempfile
        • Path C:\Users\Admin\AppData\Local\Temp\tempfile
        • Size 2.0MB
        • SHA256 1368a2f20a3944e73b37992092a0e877848a4f91762123c10a7c46456740288f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        service.log
        • Path C:\service.log
        • Size 427B
        • SHA256 e3a8dd02822de9b432509481fa320ad048030ed074cc8efeed28f5d628b819a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        yyzUSB.exe
        • Path C:\yyzUSB.exe
        • Size 2.4MB
        • SHA256 ed8fe2bc98aa221813594e5198b80fad07e0b71193e0266c0b9f1577b7707d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1984-29-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/1984-31-0x0000000000E28000-0x0000000000E29000-memory.dmp
        Download

        memory/2200-40-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/2208-43-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/2984-88-0x0000000000100000-0x00000000001F6000-memory.dmp
        Download

        memory/2984-54-0x0000000000100000-0x00000000001F6000-memory.dmp
        Download

        memory/3320-39-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3336-35-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3356-82-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3388-44-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3408-37-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3448-36-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3464-34-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3476-84-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3576-87-0x00000000004C0000-0x0000000000778000-memory.dmp
        Download

        memory/3576-12-0x00000000005D2000-0x00000000005D3000-memory.dmp
        Download

        memory/3576-5-0x00000000004C0000-0x0000000000778000-memory.dmp
        Download

        memory/3716-45-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3740-46-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3740-32-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3796-42-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/3932-33-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/4128-80-0x0000000000100000-0x00000000001F6000-memory.dmp
        Download

        memory/4128-11-0x0000000000100000-0x00000000001F6000-memory.dmp
        Download

        memory/4260-86-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download

        memory/4396-30-0x00007FF6F4236000-0x00007FF6F4237000-memory.dmp
        Download

        memory/4652-70-0x0000000000D40000-0x0000000000FF8000-memory.dmp
        Download

        memory/4656-38-0x0000000000DA0000-0x0000000000E3C000-memory.dmp
        Download