umbral | 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c

Analysis

user interaction
yes
max time kernel
43s
max time network
46s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loader.exe
Size 1.1MB
Sample260901-3krxasfc76
SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
MD5 c525491a369b3d926183c5ed3533a5d9
SHA1 365a5301bab12a7512d636a415c3fca3cf568e3d
SHA512 5e73fbf150cd593a64fb3656dfab157bbafefe3aaa1cae71cf6b5f4b6ebd3c585ff184c82165936256134d06b220c6f22b91e83caf8d2eb3cfa0f2f420620439
SSDEEP 24576:NpbdQQqZl8nmoiCqOKGnTpPs9xYo3wxoVrHUgZ:rR5qZ6m0nTpPsPy+jr
TLSH
T1583512CCB52472EED957C032CAD85C68AA50BC77831B5607A8AB106DAD4DCC7DF291F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution umbral persistence spyware stealer

Malware Config

Signatures

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral3/files/0x000e00000001c533-22.dat	disable_win_def
behavioral3/memory/4600-29-0x00000186C93D0000-0x00000186C9448000-memory.dmp	disable_win_def

Detects Umbral payload 4 IoCs

resource	yara_rule
behavioral3/files/0x000e00000001c533-22.dat	family_umbral
behavioral3/files/0x000e00000001c533-22.dat	family_umbral_obfuscated
behavioral3/memory/4600-29-0x00000186C93D0000-0x00000186C9448000-memory.dmp	family_umbral
behavioral3/memory/4600-29-0x00000186C93D0000-0x00000186C9448000-memory.dmp	family_umbral_obfuscated

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1200	powershell.exe
2984	powershell.exe
2768	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1200	powershell.exe

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1200	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3536	affe_loader.exe
4600	RuntimeBroker.exe
3260	RuntimeBroker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\W8rLh96O = "\"C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker.exe\""	RuntimeBroker.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral3/memory/4300-1-0x0000000000A40000-0x0000000000B64000-memory.dmp	ConfuserEx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4808	schtasks.exe
5240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
260	powershell.exe
260	powershell.exe
2768	powershell.exe
2768	powershell.exe
1200	powershell.exe
1200	powershell.exe
2984	powershell.exe
2984	powershell.exe
2984	powershell.exe
1952	powershell.exe
1952	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3536	affe_loader.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	powershell.exe
Token: SeIncreaseQuotaPrivilege	260	powershell.exe
Token: SeSecurityPrivilege	260	powershell.exe
Token: SeTakeOwnershipPrivilege	260	powershell.exe
Token: SeLoadDriverPrivilege	260	powershell.exe
Token: SeSystemProfilePrivilege	260	powershell.exe
Token: SeSystemtimePrivilege	260	powershell.exe
Token: SeProfSingleProcessPrivilege	260	powershell.exe
Token: SeIncBasePriorityPrivilege	260	powershell.exe
Token: SeCreatePagefilePrivilege	260	powershell.exe
Token: SeBackupPrivilege	260	powershell.exe
Token: SeRestorePrivilege	260	powershell.exe
Token: SeShutdownPrivilege	260	powershell.exe
Token: SeDebugPrivilege	260	powershell.exe
Token: SeSystemEnvironmentPrivilege	260	powershell.exe
Token: SeRemoteShutdownPrivilege	260	powershell.exe
Token: SeUndockPrivilege	260	powershell.exe
Token: SeManageVolumePrivilege	260	powershell.exe
Token: 33	260	powershell.exe
Token: 34	260	powershell.exe
Token: 35	260	powershell.exe
Token: 36	260	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeIncreaseQuotaPrivilege	2768	powershell.exe
Token: SeSecurityPrivilege	2768	powershell.exe
Token: SeTakeOwnershipPrivilege	2768	powershell.exe
Token: SeLoadDriverPrivilege	2768	powershell.exe
Token: SeSystemProfilePrivilege	2768	powershell.exe
Token: SeSystemtimePrivilege	2768	powershell.exe
Token: SeProfSingleProcessPrivilege	2768	powershell.exe
Token: SeIncBasePriorityPrivilege	2768	powershell.exe
Token: SeCreatePagefilePrivilege	2768	powershell.exe
Token: SeBackupPrivilege	2768	powershell.exe
Token: SeRestorePrivilege	2768	powershell.exe
Token: SeShutdownPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeSystemEnvironmentPrivilege	2768	powershell.exe
Token: SeRemoteShutdownPrivilege	2768	powershell.exe
Token: SeUndockPrivilege	2768	powershell.exe
Token: SeManageVolumePrivilege	2768	powershell.exe
Token: 33	2768	powershell.exe
Token: 34	2768	powershell.exe
Token: 35	2768	powershell.exe
Token: 36	2768	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeSecurityPrivilege	3372	msiexec.exe
Token: SeDebugPrivilege	4600	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3536	affe_loader.exe
3372	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 260	4300	Loader.exe	88
PID 4300 wrote to memory of 3536	4300	Loader.exe	90
PID 4300 wrote to memory of 4600	4300	Loader.exe	91
PID 4600 wrote to memory of 2768	4600	RuntimeBroker.exe	92
PID 4600 wrote to memory of 1200	4600	RuntimeBroker.exe	95
PID 4600 wrote to memory of 4808	4600	RuntimeBroker.exe	97
PID 4600 wrote to memory of 5240	4600	RuntimeBroker.exe	99
PID 4600 wrote to memory of 2984	4600	RuntimeBroker.exe	103
PID 4600 wrote to memory of 1952	4600	RuntimeBroker.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAeABsACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAaABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHcAZAB2ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHgAaAB1ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:260
- C:\Users\Admin\AppData\Roaming\affe_loader.exe
  "C:\Users\Admin\AppData\Roaming\affe_loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3536
- C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Disables automatic submission of suspicious files to Microsoft by Windows Defender
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "W8rLh96O" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4808
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks.exe" /create /tn "W8rLh96O_svc" /tr "\"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe\"" /sc minute /mo 5 /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1952

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
PID:3260

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
MD5 78b9021e0576c01ec958b87ec52832c1
SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
TLSH
T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 250fd1562b505953bb079fe3666d695fd9ee78c4b5975f2a9a6e2bc3dc4be691
MD5 a9a331de30a7df0484402b2482f7ac2a
SHA1 30f81742d20ac1b92061cd40d80181e789ec6df8
SHA512 52f97c446c15989bdd7853fc7dadab2f45fa5c164edb0bcdc5338ada29ab0190e20b0823c59d31bb99619ec6f92b53493ed00079298f114d3664ced40be696d0
TLSH
T1A3219833B3CC8614C89E003A10CDAC0036B6CBCB40DECE5B6B80E659A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 952B
SHA256 59a616a85b4c18c97628fdc91d595885cac6b00d0b8872028304b93d05cea063
MD5 785fa91f761987b9972272762d8f1035
SHA1 5a62a18dee1333059cb928690bf3253ff251356f
SHA512 d5565cbfc47ebae05bf9af9fdab784eabf7a4a9b86759f03520b4aeb35eb8b428acfe967a7c6fbf47eb21054637322e9c38207918206c00869d6e18728fe848b
TLSH
T14F116633F3CC8624DC5A403650CEAD1137B687CB40DECE6B7B80D154B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9ecf454d8b55b7bc57249021d41b3bb8ae49c6db962c081c3fcfec87c41d5373
MD5 610f4038baf99b8ee9e40266597a6f8f
SHA1 7a3f9b3694b4dd63df5788b22183418f653cda19
SHA512 150d4cc311601c7bb6d9d7068471d9217791411ee172e5a14272e4034e2bdb8b82578dcf838e0a192e9abe5a573ff170870608e353e553d46383762188c14fa0
TLSH
T1C4215333F3CC8624C89A413A50CEAC1036B687DB419ECFABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uou5tmhj.ypo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uou5tmhj.ypo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
Size 458KB
SHA256 059344941a9b0949c40ed3c0aafc6d3d4fee8de37c638be8d59c2a0156f79d91
MD5 b6114f51453005dc6fd7c49925ebaf1c
SHA1 355ccc27beae8e50c3ea00e72560af019f17bf5e
SHA512 6f6d1fc9063cd6247f7dd206eb1889b47b1db1676c833091da6a04df43342c848f525cb43968d3be922f06c266c5ec7d74f2a5fba6ce4342a7c675a80e77158d
SSDEEP 6144:pANDNvB4JAVSGuZDZAIuIW9pNnJznCGJ98beB/0XDGNTQy4R:pAHcGuZDZMDB/iy
TLSH
T194A44A9057F8D942F1BF5BB4747019AE8B73F603E9A9F74E068C41D80AA3B42D940B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

affe_loader.exe

Path C:\Users\Admin\AppData\Roaming\affe_loader.exe
Size 599KB
SHA256 e2a4bf39121b8e6c1aa71510297e40d7a008301d53f2209d302f1fd6e072d9b5
MD5 fd5685408b0fa1c4f1d5ebb8c276f7fc
SHA1 a6bc1de115ddecc7d446b4d55cc0d2d0e0d6f1dc
SHA512 4c4d4215af7955db30eb3da76504ffcd60dbe9345172409afb13fd68b8bc7972a3a6a033253e577871b1864c6cf54d98cc56bfb3fee64cb5d0cc52fc1741cba6
SSDEEP 12288:ypvrHIGev7yaY0stSpUtqSBAq/aPViYOSHYisn4903JLxdZ:2rHIXrOvA+adie4isnf3lx
TLSH
T1A8D4BF86B2F441F8D03BD239D695A61BFA76344417208ADB13E4455A3FA33E05BBF722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-25-0x000001DAC72A0000-0x000001DAC72C2000-memory.dmp

Download

memory/260-40-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-47-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-43-0x000001DAC7540000-0x000001DAC755E000-memory.dmp

Download

memory/260-18-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-45-0x000001DAC7620000-0x000001DAC762A000-memory.dmp

Download

memory/260-31-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-32-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-44-0x000001DAC7560000-0x000001DAC7612000-memory.dmp

Download

memory/260-33-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-34-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-39-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-35-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-36-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-37-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/260-38-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-30-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-4-0x000000001B9D0000-0x000000001BADE000-memory.dmp

Download

memory/4300-8-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-0-0x00007FFB528AF000-0x00007FFB528B0000-memory.dmp

Download

memory/4300-6-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-7-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-5-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-1-0x0000000000A40000-0x0000000000B64000-memory.dmp

Download

memory/4300-3-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4300-2-0x00007FFB52720000-0x00007FFB530C4000-memory.dmp

Download

memory/4600-59-0x00000186C9FA0000-0x00000186C9FF0000-memory.dmp

Download

memory/4600-61-0x00000186C9EA0000-0x00000186C9EBE000-memory.dmp

Download

memory/4600-58-0x00000186C9F20000-0x00000186C9F96000-memory.dmp

Download

memory/4600-29-0x00000186C93D0000-0x00000186C9448000-memory.dmp

Download

memory/4600-72-0x00000186C9EE0000-0x00000186C9EEA000-memory.dmp

Download

memory/4600-73-0x00000186E4F40000-0x00000186E4F52000-memory.dmp

Download