umbral | 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.1MB
Sample260819-ym3pcsvthv
SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
MD5 c525491a369b3d926183c5ed3533a5d9
SHA1 365a5301bab12a7512d636a415c3fca3cf568e3d
SHA512 5e73fbf150cd593a64fb3656dfab157bbafefe3aaa1cae71cf6b5f4b6ebd3c585ff184c82165936256134d06b220c6f22b91e83caf8d2eb3cfa0f2f420620439
SSDEEP 24576:NpbdQQqZl8nmoiCqOKGnTpPs9xYo3wxoVrHUgZ:rR5qZ6m0nTpPsPy+jr
TLSH
T1583512CCB52472EED957C032CAD85C68AA50BC77831B5607A8AB106DAD4DCC7DF291F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution umbral persistence spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000e00000001c452-20.dat	disable_win_def
behavioral2/memory/5040-29-0x0000026D9B070000-0x0000026D9B0E8000-memory.dmp	disable_win_def

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c452-20.dat	family_umbral
behavioral2/files/0x000e00000001c452-20.dat	family_umbral_obfuscated
behavioral2/memory/5040-29-0x0000026D9B070000-0x0000026D9B0E8000-memory.dmp	family_umbral
behavioral2/memory/5040-29-0x0000026D9B070000-0x0000026D9B0E8000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5588	powershell.exe
680	powershell.exe
2812	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
680	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
680	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5076	affe_loader.exe
5040	RuntimeBroker.exe
824	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZxumSDs6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe\""	RuntimeBroker.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/5996-1-0x0000000000770000-0x0000000000894000-memory.dmp	ConfuserEx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3408	schtasks.exe
4800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5244	powershell.exe
5244	powershell.exe
5244	powershell.exe
5588	powershell.exe
5588	powershell.exe
5588	powershell.exe
680	powershell.exe
680	powershell.exe
680	powershell.exe
2812	powershell.exe
2812	powershell.exe
2812	powershell.exe
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5076	affe_loader.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5588	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe
Token: 34	5244	powershell.exe
Token: 35	5244	powershell.exe
Token: 36	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5588	powershell.exe
Token: SeSecurityPrivilege	5588	powershell.exe
Token: SeTakeOwnershipPrivilege	5588	powershell.exe
Token: SeLoadDriverPrivilege	5588	powershell.exe
Token: SeSystemProfilePrivilege	5588	powershell.exe
Token: SeSystemtimePrivilege	5588	powershell.exe
Token: SeProfSingleProcessPrivilege	5588	powershell.exe
Token: SeIncBasePriorityPrivilege	5588	powershell.exe
Token: SeCreatePagefilePrivilege	5588	powershell.exe
Token: SeBackupPrivilege	5588	powershell.exe
Token: SeRestorePrivilege	5588	powershell.exe
Token: SeShutdownPrivilege	5588	powershell.exe
Token: SeDebugPrivilege	5588	powershell.exe
Token: SeSystemEnvironmentPrivilege	5588	powershell.exe
Token: SeRemoteShutdownPrivilege	5588	powershell.exe
Token: SeUndockPrivilege	5588	powershell.exe
Token: SeManageVolumePrivilege	5588	powershell.exe
Token: 33	5588	powershell.exe
Token: 34	5588	powershell.exe
Token: 35	5588	powershell.exe
Token: 36	5588	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeSecurityPrivilege	3224	msiexec.exe
Token: SeDebugPrivilege	5040	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	affe_loader.exe
3224	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 5244	5996	Loader.exe	89
PID 5996 wrote to memory of 5076	5996	Loader.exe	91
PID 5996 wrote to memory of 5040	5996	Loader.exe	92
PID 5040 wrote to memory of 5588	5040	RuntimeBroker.exe	93
PID 5040 wrote to memory of 680	5040	RuntimeBroker.exe	96
PID 5040 wrote to memory of 3408	5040	RuntimeBroker.exe	98
PID 5040 wrote to memory of 4800	5040	RuntimeBroker.exe	100
PID 5040 wrote to memory of 2812	5040	RuntimeBroker.exe	104
PID 5040 wrote to memory of 2312	5040	RuntimeBroker.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAeABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAaABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAZAB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAaAB1ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Users\Admin\AppData\Roaming\affe_loader.exe
  "C:\Users\Admin\AppData\Roaming\affe_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5076
- C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "ZxumSDs6" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "ZxumSDs6_svc" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc minute /mo 5 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2312

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 06ed276ac8635731360642d55b735d02948f8bd9736bc0d6cb07b0cd4c4ae527
MD5 58ceb6ed6add6bc9da167717c36ac2a2
SHA1 e9da38128f0e53dd6d658ecabac185d80bb83bc0
SHA512 7a50315d9568d1892bee7c34fe6800d7f58a277af21099ef208d534b28f4af9b4493a7c15440db14cc916aa238835130c08ce743cd40c2058d4da4084f95f5e0
TLSH
T1DD116633F3CC8628DC59403650CEAD1137B687CB40DECEAB7B80D154B46F689DEA0160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lxp1ts5e.usl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxp1ts5e.usl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
Size 458KB
SHA256 059344941a9b0949c40ed3c0aafc6d3d4fee8de37c638be8d59c2a0156f79d91
MD5 b6114f51453005dc6fd7c49925ebaf1c
SHA1 355ccc27beae8e50c3ea00e72560af019f17bf5e
SHA512 6f6d1fc9063cd6247f7dd206eb1889b47b1db1676c833091da6a04df43342c848f525cb43968d3be922f06c266c5ec7d74f2a5fba6ce4342a7c675a80e77158d
SSDEEP 6144:pANDNvB4JAVSGuZDZAIuIW9pNnJznCGJ98beB/0XDGNTQy4R:pAHcGuZDZMDB/iy
TLSH
T194A44A9057F8D942F1BF5BB4747019AE8B73F603E9A9F74E068C41D80AA3B42D940B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

affe_loader.exe

Path C:\Users\Admin\AppData\Roaming\affe_loader.exe
Size 599KB
SHA256 e2a4bf39121b8e6c1aa71510297e40d7a008301d53f2209d302f1fd6e072d9b5
MD5 fd5685408b0fa1c4f1d5ebb8c276f7fc
SHA1 a6bc1de115ddecc7d446b4d55cc0d2d0e0d6f1dc
SHA512 4c4d4215af7955db30eb3da76504ffcd60dbe9345172409afb13fd68b8bc7972a3a6a033253e577871b1864c6cf54d98cc56bfb3fee64cb5d0cc52fc1741cba6
SSDEEP 12288:ypvrHIGev7yaY0stSpUtqSBAq/aPViYOSHYisn4903JLxdZ:2rHIXrOvA+adie4isnf3lx
TLSH
T1A8D4BF86B2F441F8D03BD239D695A61BFA76344417208ADB13E4455A3FA33E05BBF722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5040-29-0x0000026D9B070000-0x0000026D9B0E8000-memory.dmp

Download

memory/5040-77-0x0000026D9BFC0000-0x0000026D9BFD2000-memory.dmp

Download

memory/5040-76-0x0000026D9BF90000-0x0000026D9BF9A000-memory.dmp

Download

memory/5040-65-0x0000026D9BE90000-0x0000026D9BEAE000-memory.dmp

Download

memory/5040-64-0x0000026D9BEB0000-0x0000026D9BF00000-memory.dmp

Download

memory/5040-63-0x0000026D9BF00000-0x0000026D9BF76000-memory.dmp

Download

memory/5244-50-0x000001BF7C9A0000-0x000001BF7CA52000-memory.dmp

Download

memory/5244-45-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-60-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-30-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-51-0x000001BF7CA60000-0x000001BF7CA6A000-memory.dmp

Download

memory/5244-33-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-34-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-35-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-36-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-37-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-38-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-39-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-40-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-41-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-44-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-32-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-46-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5244-49-0x000001BF7C980000-0x000001BF7C99E000-memory.dmp

Download

memory/5244-24-0x000001BF7C8E0000-0x000001BF7C902000-memory.dmp

Download

memory/5996-1-0x0000000000770000-0x0000000000894000-memory.dmp

Download

memory/5996-25-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-21-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-31-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-12-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-7-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-5-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-4-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-3-0x000000001B740000-0x000000001B84E000-memory.dmp

Download

memory/5996-2-0x00007FFB6CDD0000-0x00007FFB6D774000-memory.dmp

Download

memory/5996-0-0x00007FFB6CF5F000-0x00007FFB6CF60000-memory.dmp

Download