d83052f3603f335a00595c3d8b69c3b46a2561d8feadc35c911473bcb03907ac

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261023-wse45sty2p
SHA256 d83052f3603f335a00595c3d8b69c3b46a2561d8feadc35c911473bcb03907ac
MD5 71bd359e5db435ee74ba60508f0021d7
SHA1 c427999ed79a11751bbc6e00a1b94362e29494c4
SHA512 bacbedf80e3a87bc3bc1230532612261eae74a6b8c881b65d26993aaab5ad4d1200c2060eb735641340e12799d01b307abd56c7dd86f9d704a123d3c3dad5673
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXB:q6chqTShW/hNbSiQfMJPLmrUlsB
TLSH
T1F897D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5364	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2724	Dhyupa.exe

Loads dropped DLL 1 IoCs

pid	Process
2724	Dhyupa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\YoBB48\\Dhyupa.exe\""	Dhyupa.exe

Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3716	cmd.exe
1212	cmd.exe
1352	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Dhyupa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1132	cmd.exe
5840	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Dhyupa.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Dhyupa.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1164	schtasks.exe
3332	schtasks.exe
4084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
4276	install.2.0.02.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe
2724	Dhyupa.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 5364	2724	Dhyupa.exe	92
PID 2724 wrote to memory of 3716	2724	Dhyupa.exe	94
PID 3716 wrote to memory of 1164	3716	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Users\Public\YoBB48\Dhyupa.exe
"C:\Users\Public\YoBB48\Dhyupa.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\YoBB48\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\YoBB48\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5836
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:1352
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4084

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\YoBB48" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1132

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5908

C:\Users\Public\YoBB48\Dhyupa.exe
"C:\Users\Public\YoBB48\Dhyupa.exe"
1⤵
PID:1548

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 d91769a3c599bbde8b22c983fb33ac0793804ad8bef05d30861a1ac6c19a29d7
MD5 81fe5ef00e8e16b021c604d824cf1209
SHA1 f2bc5e055d47b6408121101a5c6c425b7672d9c4
SHA512 fe85b99643a1331bd2010fd35008b724142ec5601948c9550aa64c8ed5b02b1dd7cb9e58caac24d3981693e2aeb2bf093e23aef832a8e6b1cb21c58973faa8ee
TLSH
T1D831A4FB4BACBC829F294DD925CAB1322DE5E2D05C8614AA2215C4949F043B12F0A90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a6b0f6a44dd96965a00f4e245bf186c12f6ff9f63bb9cb6c82d0e40b4ec561ac
MD5 bcd4b0559361f9a709e5c758e66bea37
SHA1 eb0f3410d134d5d0d7e22d706b22436bb29ba674
SHA512 e359408a9c99a3155c0b0e9bfc2ffc54faecdcbaac4dbe09de83ab93a402de39d81f644f1fc98bae16bf125a1468e6f6a383417babeb667ed936b0bd06150aca
TLSH
T12531D6A34E350012DF1C5F3096C0D13BBCF2AAB45DE808416A6EE2AE961AB774FC5495
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d395c663fe56d944de2ec7f80183fb784d48fcc6e8acc22b1794493311c1ce6a
MD5 6e52e425e728e55eff1c7afb51e19ed3
SHA1 67c6fb0a864b284e7fe582f10cbe1959d93e20fe
SHA512 26483efb5c718ba6dd5528d74c828c15d4768345e87f8b2753f883b465470b5f426f27c34b2956c672dc38c675a2d79fa0dfe4b8b20d1c3ef691c4d9f307612f
TLSH
T17CF0DC0C187C412DF572EA784AD939AA1AFAEA44240281E046F50B0EA616C413D216BD
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 d2826c25c1c9f2342cdd48f354af203943f12260db919554b2fa9a7f1dcd0cc9
MD5 784adc9789f2c25b4605b12a8fa68607
SHA1 7490e257c9a4cc740224dc77106884ac283682ae
SHA512 5ab35ae8e3b0d0ca6dad3ef0117ff7fa2af0badd644fde836eef17493cecb7113dc099847f5ae01caa9b9eed47d51c1f3234751904d64d54e7ffd90be9a62f71
TLSH
T1FCF05C3C52DA814FF23BD1B456C23AF25739E122600A62AE09F803482E64A406C4226E
MD5 SHA1 SHA512 TLSH

Submit Download

Dhyupa.exe

Path C:\Users\Public\YoBB48\Dhyupa.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\YoBB48\UxEnhance64.dll
Size 3.1MB
SHA256 7516445585087951c3589bd73daa00efb0deece5544a62229742e83170bdf9d7
MD5 f4241c90ed0881f315d16ec29507d3bd
SHA1 7ece51872948f8209c426be15e92ab6d6e0f216a
SHA512 d226b1194f907f5ae5cba43015621954f2e5916bfb807248ea0a5842caf70a751042384a38fef3d846bfc3e6ef121186a268da8379d339a47ba91add5e6c2439
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+i:P9m29xx3Tiqt06ox6+z2rNNrKoi
TLSH
T121E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\YoBB48\adoresd.dat
Size 4.8MB
SHA256 96b20e86690411d4caed9f72812d6d3e8f97ab8392a252f78e24bffec65c044a
MD5 a2426099a34d372733ccba1b2cbf53b4
SHA1 6621dc06ebc93f0f4662a4024088842bdfcd252d
SHA512 871be3cd90a0808de2defca6b9be1857071fd8fee2d8d0fb5858924e1b709cdd69758e8fc2c59428d62ee98849097355a298687adb3853d87cf270611a3a549e
SSDEEP 98304:NWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:NWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1C53633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\YoBB48\msadox.tb
Size 8KB
SHA256 d4628af53e512c8252fe834da786031c6c322b29898f2cc06bafe138dbf51d79
MD5 4b6393d5528e2aa3876721c4b156fb95
SHA1 6fc76117ba0db26c346a7615cf67c034af65eb03
SHA512 a1180565e9cebacad1286cea96e2f17978969bf064187b42a1d08766dd19056a9b595fbe3383783ef78c4cb2c18d8626081460056cbe9359c57eee08ea0e1ba5
SSDEEP 192:4qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:4sZqZOXQ3uqvR2Kfzp
TLSH
T151029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1548-577-0x00007FF9FBFA0000-0x00007FF9FC4BE000-memory.dmp

Download

memory/1548-589-0x00000211D6810000-0x00000211D70E7000-memory.dmp

Download

memory/1548-591-0x00000211D6810000-0x00000211D70E7000-memory.dmp

Download

memory/1548-590-0x00000211D6810000-0x00000211D70E7000-memory.dmp

Download

memory/1548-592-0x00000211D6810000-0x00000211D70E7000-memory.dmp

Download

memory/1548-593-0x00007FFA1D790000-0x00007FFA1D792000-memory.dmp

Download

memory/1548-584-0x00007FFA1D7A0000-0x00007FFA1D7A2000-memory.dmp

Download

memory/1548-580-0x00000211D6810000-0x00000211D70E7000-memory.dmp

Download

memory/2724-560-0x000001E08DD20000-0x000001E08DDAA000-memory.dmp

Download

memory/2724-567-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-545-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-550-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-561-0x000001E08DD20000-0x000001E08DDAA000-memory.dmp

Download

memory/2724-562-0x000001E08DD20000-0x000001E08DDAA000-memory.dmp

Download

memory/2724-556-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-530-0x00007FFA1D790000-0x00007FFA1D792000-memory.dmp

Download

memory/2724-559-0x000001E08DD20000-0x000001E08DDAA000-memory.dmp

Download

memory/2724-558-0x000001E08DC40000-0x000001E08DC8E000-memory.dmp

Download

memory/2724-566-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-546-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-531-0x00007FF9FBFA0000-0x00007FF9FC4BE000-memory.dmp

Download

memory/2724-536-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-538-0x00007FFA1D7A0000-0x00007FFA1D7A2000-memory.dmp

Download

memory/2724-539-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-544-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/2724-543-0x000001E08CF80000-0x000001E08D857000-memory.dmp

Download

memory/4276-1-0x0000000000540000-0x000000000054E000-memory.dmp

Download

memory/4276-2-0x0000000002160000-0x000000000216C000-memory.dmp

Download

memory/4276-504-0x00007FFA119B0000-0x00007FFA119C2000-memory.dmp

Download

memory/4276-0-0x0000000000540000-0x000000000054E000-memory.dmp

Download

memory/4276-524-0x0000000000540000-0x000000000054E000-memory.dmp

Download

memory/4276-525-0x00007FFA119B0000-0x00007FFA119C2000-memory.dmp

Download