Overview

overview

6

Static

static

3

2026-10-17...lc.exe

windows10-2004-x64

6

2026-10-17...lc.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 19:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
  • Size 18.0MB
  • Sample261018-x49cssgv8j
  • SHA256 fc3d348e478da0f8c2430e59de23bec022a6eb0110690cb516e5176ecf70be92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 12 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4196.4412.9004317514739025932 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
      2⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView /prefetch:4 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x140,0x7ffe8e3e5fd8,0x7ffe8e3e5fe4,0x7ffe8e3e5ff0
        3⤵
          PID:1184
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
          3⤵
            PID:596
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
            3⤵
              PID:3308
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
              3⤵
                PID:2796
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3428 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c /prefetch:1
                3⤵
                  PID:1064
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4352 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
                  3⤵
                    PID:5548
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
                    3⤵
                      PID:2332
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
                      3⤵
                        PID:5536
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4624 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
                        3⤵
                          PID:1172
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView" --webview-exe-name=2026-10-17_c91966f52a62887501b5634a52af972c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4580 --field-trial-handle=1776,i,15699778430669132446,7656296105924149820,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1679a942b770d1cd845d4837a20fc03bae88ab2c
                          3⤵
                            PID:4780

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            35fabd5a-acad-4d4e-aa2a-ce59f9047baa.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\35fabd5a-acad-4d4e-aa2a-ce59f9047baa.tmp
                            • Size 15KB
                            • SHA256 739d50f79816f9fa99c1b5b79cd09eb3e69827f30645cedf5bb84777c3bf6877
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            8ccfd04f-115c-49d5-b736-abd801f2b4fa.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\8ccfd04f-115c-49d5-b736-abd801f2b4fa.tmp
                            • Size 3KB
                            • SHA256 4c8c42fc5bf672dce81fa8538dfdee4bb4a3404cb566f7ae294195208ca058d1
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 194b558b476d510e8953b152ac34d057dd9d5711d0405289f4e75be40c5d6218
                            • MD5 SHA1 SHA512
                            Submit Download

                            settings.dat
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Crashpad\settings.dat
                            • Size 280B
                            • SHA256 4b58115d55dceb7ef144cbb36d4a12b435fb49e5d5dabf278c291df2eca5ad4b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            throttle_store.dat
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Crashpad\throttle_store.dat
                            • Size 20B
                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                            • MD5 SHA1 SHA512
                            Submit Download

                            0b477044-1dac-4f29-9165-729cc3051ef3.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\0b477044-1dac-4f29-9165-729cc3051ef3.tmp
                            • Size 6KB
                            • SHA256 a9dc792a8d26a05905c317d30d7a2101a0388fc88baca76d5e185e013e91de99
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            1a85e83f-c689-47ca-9213-67a4301b25ae.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\1a85e83f-c689-47ca-9213-67a4301b25ae.tmp
                            • Size 6KB
                            • SHA256 19cf2a773e037948d2bfc525c026317a9342150d141605907730fecb1fa39eee
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            CURRENT
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\Extension Rules\CURRENT
                            • Size 16B
                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                            • MD5 SHA1 SHA512
                            Submit Download

                            MANIFEST-000001
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\Extension Scripts\MANIFEST-000001
                            • Size 41B
                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                            • MD5 SHA1 SHA512
                            Submit Download

                            60f12506-8346-49be-ade5-a67068398673.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\Network\60f12506-8346-49be-ade5-a67068398673.tmp
                            • Size 230B
                            • SHA256 ba052c31eacb0a8deb26dee075517276d2790023f26eb8730d7f00596fd83644
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Network Persistent State
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\Network\Network Persistent State
                            • Size 59B
                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            SCT Auditing Pending Reports
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                            • Size 2B
                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                            • MD5 SHA1 SHA512
                            Submit Download

                            data_0
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\GrShaderCache\data_0
                            • Size 8KB
                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_1
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\GrShaderCache\data_1
                            • Size 264KB
                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_2
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\GrShaderCache\data_2
                            • Size 8KB
                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            data_3
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\GrShaderCache\data_3
                            • Size 8KB
                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Local State
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\Local State
                            • Size 1KB
                            • SHA256 b77cc680b638fee1548067154c2c61218e30857b9afa76580f99e716ace687d5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            f43d3cd0-5f4c-4718-8634-1d362d85487f.tmp
                            • Path C:\Users\Admin\AppData\Roaming\ginger.wtf\wv2\EBWebView\f43d3cd0-5f4c-4718-8634-1d362d85487f.tmp
                            • Size 2KB
                            • SHA256 38f7d609a1849d10de983dbdfd130d8df71028891da3ca6ac1e91a804928964f
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_117700374\manifest.json
                            • Size 135B
                            • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1268510299\manifest.json
                            • Size 108B
                            • SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            manifest.json
                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_1397183768\manifest.json
                            • Size 43B
                            • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                            • MD5 SHA1 SHA512
                            Submit Download

                            manifest.json
                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2620_745191086\manifest.json
                            • Size 76B
                            • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/596-123-0x00007FFEAEBF0000-0x00007FFEAEBF1000-memory.dmp
                            Download

                            memory/596-227-0x000001EF59D50000-0x000001EF59DF7000-memory.dmp
                            Download

                            memory/1064-120-0x00007FFEAEBF0000-0x00007FFEAEBF1000-memory.dmp
                            Download

                            memory/1064-228-0x0000025DD1350000-0x0000025DD13F7000-memory.dmp
                            Download

                            memory/1172-361-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-353-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-351-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-357-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-362-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-360-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-359-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/1172-358-0x000001FDD4080000-0x000001FDD4081000-memory.dmp
                            Download

                            memory/2620-206-0x0000022E6F310000-0x0000022E6F551000-memory.dmp
                            Download

                            memory/5548-256-0x00007FFEAE970000-0x00007FFEAE971000-memory.dmp
                            Download

                            memory/5548-257-0x00007FFEAEE40000-0x00007FFEAEE41000-memory.dmp
                            Download