8e4c5d232d6a1d98d88a52565379f1c8e85fe297910fc4d4f526a0f0375932a5

Analysis

max time kernel
298s
max time network
250s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 545KB
Sample260819-ampkqstdmb
SHA256 8e4c5d232d6a1d98d88a52565379f1c8e85fe297910fc4d4f526a0f0375932a5
MD5 a8f68066b2e990d00aafc93f7b5f6156
SHA1 fe9a45c7562567ba191ff6c79a375c7ee8af3a65
SHA512 c2eab5571f5519069849b529827237572be0fd1ed30e74c6ba833330d97e08888de8a9824c2db4aa49ec94f73a1c9b02b81a841a734d702179b7cd0c3810df87
SSDEEP 12288:6b971VO6Ym9FT0CrZXt9HmlZs/ekTODtA:y77ZZ9TXmie5A
TLSH
T15CC4F106F75904E9D029C1B9959A1666B7F37C019B20A5EF03A4864B2F27BC46F3EF24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\untold\snoiantsards	setup.exe
File opened for modification	C:\Program Files\Python310\uncyuacs	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3552	chrome.exe
6008	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5248	setup.exe
5248	setup.exe
3448	chrome.exe
3448	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3448	chrome.exe
3448	chrome.exe
3396	msedge.exe
3396	msedge.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3448	chrome.exe
Token: SeCreatePagefilePrivilege	3448	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5248	setup.exe
3396	msedge.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe
3448	chrome.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 3344	5248	setup.exe	56
PID 3448 wrote to memory of 4644	3448	chrome.exe	85
PID 3396 wrote to memory of 4664	3396	msedge.exe	86
PID 3396 wrote to memory of 6008	3396	msedge.exe	87
PID 3396 wrote to memory of 5540	3396	msedge.exe	88
PID 3396 wrote to memory of 5540	3396	msedge.exe	88
PID 3396 wrote to memory of 5540	3396	msedge.exe	88
PID 3396 wrote to memory of 1288	3396	msedge.exe	89
PID 3396 wrote to memory of 1288	3396	msedge.exe	89
PID 3448 wrote to memory of 4080	3448	chrome.exe	91
PID 3448 wrote to memory of 4080	3448	chrome.exe	91
PID 3448 wrote to memory of 3552	3448	chrome.exe	92
PID 3448 wrote to memory of 5076	3448	chrome.exe	93
PID 3448 wrote to memory of 5076	3448	chrome.exe	93
PID 3448 wrote to memory of 692	3448	chrome.exe	95
PID 3448 wrote to memory of 692	3448	chrome.exe	95
PID 3448 wrote to memory of 2172	3448	chrome.exe	96
PID 3448 wrote to memory of 2172	3448	chrome.exe	96
PID 3396 wrote to memory of 6136	3396	msedge.exe	97
PID 3396 wrote to memory of 4844	3396	msedge.exe	98
PID 3396 wrote to memory of 6136	3396	msedge.exe	97
PID 3396 wrote to memory of 6136	3396	msedge.exe	97
PID 3396 wrote to memory of 4844	3396	msedge.exe	98
PID 3396 wrote to memory of 4844	3396	msedge.exe	98
PID 3448 wrote to memory of 2536	3448	chrome.exe	99
PID 3448 wrote to memory of 2536	3448	chrome.exe	99
PID 3448 wrote to memory of 1436	3448	chrome.exe	100
PID 3448 wrote to memory of 1436	3448	chrome.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3344
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x374,0x7ffdd2dfc188,0x7ffdd2dfc194,0x7ffdd2dfc1a0
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,15829001890892258490,4120867642222300322,524288 --field-trial-handle=2252,i,6976841383728514371,7110533037675955455,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - System Time Discovery
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16036953758296698103,17821321247944017780,262144 --field-trial-handle=2252,i,6976841383728514371,7110533037675955455,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,9243932344501666734,9882804021321236609,524288 --field-trial-handle=2252,i,6976841383728514371,7110533037675955455,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,6951680483416751669,638700370570710388,2097152 --field-trial-handle=2252,i,6976841383728514371,7110533037675955455,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14740442350985343650,13884853299055899122,2097152 --field-trial-handle=2252,i,6976841383728514371,7110533037675955455,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffdb5a4c728,0x7ffdb5a4c734,0x7ffdb5a4c740
    3⤵
    PID:4644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,4367622390638192065,8982692767778056234,262144 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2008 /prefetch:2
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1600,i,5110110384722902603,14950005947797756253,524288 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2460 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,12068596001274749013,5336555322252918327,524288 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2468 /prefetch:8
    3⤵
    PID:5076
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,14633048088309037117,14076591885003837537,2097152 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3212 /prefetch:1
    3⤵
    PID:692
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,13301427860990302485,7416534801788966993,2097152 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:2172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4232,i,3501342996015740045,14555102911162725046,2097152 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4248 /prefetch:2
    3⤵
    PID:2536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4544,i,16879448162956336016,13528116853914536430,2097152 --field-trial-handle=2012,i,16248714041079962929,6379130890451609712,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4564 /prefetch:1
    3⤵
    PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3948

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9713cabd-6dcd-481e-9a7f-33168b7c270b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9713cabd-6dcd-481e-9a7f-33168b7c270b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 295199e7d6d4169346a4201288779adcf0d4bfdad70cb8c1fc4d01acebc13e12
MD5 764f07a97360f5c80efd2d456fd549a9
SHA1 c79fb759b49e5901d98386bc708d55d55f9afce2
SHA512 f43aec64522fc53d75b04981e77d04e02f97e524fb55bfec5730a9f77d4c95a4e8d9c7f0a5f10a8ad430239c03765e2971bfd3da643372283639ec6bd149473b
SSDEEP 1536:XJwZlAmf1mWUYZchNBoXUF1F8Mh9azKCW3iw9xODQ7B6wQtLPyedtK0XMBg/Qu+y:5w3LffUnBKU/F8enCW3iyVEXGey0cB1i
TLSH
T160B31231E5A6FE6BA369562AB50F93181CE249FB44E1B788447C3F19F0C6288FF58C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8365d8597d396643eb3cb27ae8751c52f3b1ae3e25576cd2bd50becbaaae5ffd
MD5 b16e94a14013394e81faaffb1edb0866
SHA1 095be96d92aca0f788caa8c464e88fe0093428bb
SHA512 d08bfded37a6166d23fc97a47902156684e9e48ea9630c13d74b30f201e0b1cbdefd310a06a35543c33ad6c261585c043ccdbbaf6a515ba32c8540521104e42a
TLSH
T12CD022223B4AB000E2AB4132E2228740236908A128824604A218C86C4EA00C022C22C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4479a36b7b992bbec7177088f2e15db8dffdd7e78e85279d2c83088a29343e2
MD5 03578bb8b6e22240ff9f962052e3bfd0
SHA1 e88cfa2a99ba4cde156cb76df3c1e5e4d0f31844
SHA512 14b486114c608d9c481d03eaacc4af4e96cd2250b09e5c1fbb1fe214e6bcbd9291efe72cc52c99c5a4d7d0533399a4d773de86fc6cc9233bb147b5ebe349bec8
TLSH
T177D0C0333F4AB000E2EB4132F363C740337D04A12C824604A25CC87C4EF00C022C22C7
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6536a30f56fd339a848ea82eaf744475798b135ac73ad50906a8984880d12e6d
MD5 8911b4eb6b6417c5cea686966176d64b
SHA1 e315779d583841de61e4b39a74662561b4049dfa
SHA512 ab8192d86e1458fee829af8a237995126418f6a9bfa22cbc595462436f5984e12143687c425cb091d5154fc325a351ce15d032d2073a315a58aac34db9c24197
SSDEEP 384:nZiF9CcmyWCs3sNk8TUNTUlImkrn7fWmGmiBf+UG0QpSfYcze4KV8p0pHkty/7Il:wFccps3jwgkFGrIfYczI8p0ZK
TLSH
T19DB26C35EC58CABBECE64F99B74A7607DEE01167868889D8DAD85D0D00872DD070B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 808d66f30a4706e91eddd9eefefadfa2fb99494c87714b9a045af4b3fdcd4c6d
MD5 d2de832776cf15159c82b02a28e10743
SHA1 650aadba533d25e0386a63e6c1162cbc7690496d
SHA512 1a1a416375c33a16ec7a267a888e95b2162b5436e8e8372fbad657ceacf09c3e669dc9ac23c11b9d4dc1c03b529da946781cf56199d37dfc522655fa7debc1e7
SSDEEP 384:nniF9CcmyWCs3sNk8TUNTUlImkrn7fWWVUiBf+UG0QpSf++jAcXe4KV8p0pHktyk:iFccps3zwgzDGrIf+MAcXI8p0ZK
TLSH
T1C5C26C35EC58C9BBECE64F99F74A7607DEE0116786C88AE8DAD85D0D00932DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3344-0-0x00000000026D0000-0x000000000273B000-memory.dmp

Download

memory/3344-98-0x00000000026D0000-0x000000000273B000-memory.dmp

Download