d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Size 170KB
Sample261102-l9f3nagy4y
SHA256 d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf
MD5 901ff7df218f19164e4d289fd6a7064e
SHA1 4bdceade9e88243e39c4c0ce1c6293bc88e9fa92
SHA512 6c4446228e4391bd94a1af2cadb7a809bcf8ce7e4e0cbf2e1935f6545e2334a734fedb2187f02ecbf4f8d34bb702e76a12ded19dd32ea4e964b254ef2fec8398
SSDEEP 3072:e51Wa8DwZU1jQupA47HGdK9ezOWSOSBdC2jPO7c4SyUMCx1asgG4PPAs2TH6Pz9L:e51Wa8DsU1jQKA47HGdK9ezOWSOSBdCL
TLSH
T1B0048D2570D2C0B3D476193114F48BB19ABDBC710B915EBB27E81B3E2E346E19527AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	gsEs088VEBSt.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	gsEs088VEBSt.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	gsEs088VEBSt.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	gsEs088VEBSt.exe

Downloads MZ/PE file 15 IoCs

flow	pid	Process
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
9	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
11	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
14	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	gsEs088VEBSt.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	gsEs088VEBSt.exe

Executes dropped EXE 15 IoCs

pid	Process
1620	CsvkjT8rm2z.exe
4368	XOamdwSKKXG.exe
3752	wP0ULTCyGGd.exe
5556	UzangarV9vnWN.exe
5416	M97tRgNESpzp.exe
1476	JYTryutqA9.exe
5808	LtvS7opfk.exe
860	p387mk1jT.exe
4860	FKNwxQSsauA.exe
6036	n4viMvzouwbhk.exe
5240	se8TQNRCWptr.exe
3248	6ogM9plCMX1EP.exe
5592	gsEs088VEBSt.exe
4868	cLvQBKTquS.exe
1048	tHtL8P3UeRa.exe

Loads dropped DLL 1 IoCs

pid	Process
5592	gsEs088VEBSt.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	gsEs088VEBSt.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	gsEs088VEBSt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	gsEs088VEBSt.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	gsEs088VEBSt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	gsEs088VEBSt.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe
5592	gsEs088VEBSt.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1620	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	89
PID 2600 wrote to memory of 4368	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	91
PID 2600 wrote to memory of 3752	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	93
PID 2600 wrote to memory of 5556	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	95
PID 2600 wrote to memory of 5416	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	97
PID 2600 wrote to memory of 1476	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	99
PID 2600 wrote to memory of 5808	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	101
PID 2600 wrote to memory of 860	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	104
PID 2600 wrote to memory of 4860	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	106
PID 2600 wrote to memory of 6036	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	108
PID 2600 wrote to memory of 5240	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	110
PID 2600 wrote to memory of 3248	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	112
PID 2600 wrote to memory of 5592	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	114
PID 2600 wrote to memory of 4868	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	115
PID 2600 wrote to memory of 1048	2600	d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe	117

C:\Users\Admin\AppData\Local\Temp\d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe
"C:\Users\Admin\AppData\Local\Temp\d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Roaming\bLXA0ep\CsvkjT8rm2z.exe
  "C:\Users\Admin\AppData\Roaming\bLXA0ep\CsvkjT8rm2z.exe"
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Users\Admin\AppData\Roaming\pSljVf5\XOamdwSKKXG.exe
  "C:\Users\Admin\AppData\Roaming\pSljVf5\XOamdwSKKXG.exe"
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Users\Admin\AppData\Roaming\7YLYZn6N3r\wP0ULTCyGGd.exe
  "C:\Users\Admin\AppData\Roaming\7YLYZn6N3r\wP0ULTCyGGd.exe"
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Users\Admin\AppData\Roaming\vyp1fRHHA\UzangarV9vnWN.exe
  "C:\Users\Admin\AppData\Roaming\vyp1fRHHA\UzangarV9vnWN.exe"
  2⤵
  - Executes dropped EXE
  PID:5556
- C:\Users\Admin\AppData\Roaming\T17v9Wu0u\M97tRgNESpzp.exe
  "C:\Users\Admin\AppData\Roaming\T17v9Wu0u\M97tRgNESpzp.exe"
  2⤵
  - Executes dropped EXE
  PID:5416
- C:\Users\Admin\AppData\Roaming\jkCb2X66\JYTryutqA9.exe
  "C:\Users\Admin\AppData\Roaming\jkCb2X66\JYTryutqA9.exe"
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Users\Admin\AppData\Roaming\gWZtX8Ib\LtvS7opfk.exe
  "C:\Users\Admin\AppData\Roaming\gWZtX8Ib\LtvS7opfk.exe"
  2⤵
  - Executes dropped EXE
  PID:5808
- C:\Users\Admin\AppData\Roaming\HDVh1Tm\p387mk1jT.exe
  "C:\Users\Admin\AppData\Roaming\HDVh1Tm\p387mk1jT.exe"
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Users\Admin\AppData\Roaming\sGBNAJf6Ki\FKNwxQSsauA.exe
  "C:\Users\Admin\AppData\Roaming\sGBNAJf6Ki\FKNwxQSsauA.exe"
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Users\Admin\AppData\Roaming\M3nXg0U9E\n4viMvzouwbhk.exe
  "C:\Users\Admin\AppData\Roaming\M3nXg0U9E\n4viMvzouwbhk.exe"
  2⤵
  - Executes dropped EXE
  PID:6036
- C:\Users\Admin\AppData\Roaming\on219dDDz\se8TQNRCWptr.exe
  "C:\Users\Admin\AppData\Roaming\on219dDDz\se8TQNRCWptr.exe"
  2⤵
  - Executes dropped EXE
  PID:5240
- C:\Users\Admin\AppData\Roaming\eYRWf53y\6ogM9plCMX1EP.exe
  "C:\Users\Admin\AppData\Roaming\eYRWf53y\6ogM9plCMX1EP.exe"
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Users\Admin\AppData\Roaming\2w8bYqsN\gsEs088VEBSt.exe
  "C:\Users\Admin\AppData\Roaming\2w8bYqsN\gsEs088VEBSt.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5592
- C:\Users\Admin\AppData\Roaming\auOuyMCqqQM\cLvQBKTquS.exe
  "C:\Users\Admin\AppData\Roaming\auOuyMCqqQM\cLvQBKTquS.exe"
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Users\Admin\AppData\Roaming\8NtQlVQuhs\tHtL8P3UeRa.exe
  "C:\Users\Admin\AppData\Roaming\8NtQlVQuhs\tHtL8P3UeRa.exe"
  2⤵
  - Executes dropped EXE
  PID:1048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~2fb13d8c.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\~2fb13d8c.dat
Size 926KB
SHA256 6606ea30c164992165c752ea25e997bf1e4191d008ff15edd4996ba523e8633e
MD5 d1cd342e68b10527fbf7455f0c285f2e
SHA1 957f21b52a740f58838cd72dd6c3e2e3a94b553b
SHA512 0cf57fdba577d1524b83ab70e7d1c706ca8d545a91bb38d6922ea53be60f1a588449247bc7bb24a162e28122647bb8b392b821f3c624f961c793fbb60e873118
SSDEEP 24576:Kr8XEmwyQcRN3mrq1KMxVbRIyvnkFwKvQgr/dmSly8wGZyczgh9Neo2wsYAHsUeF:y8UmwyQcRN3mrq1KMxVbRIyvnkFwKvQX
TLSH
T1A6156C1472A352C6E037553AD5CEBA17B1B2BC165AE0DF2B0A408FC76AD3260376B357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YCL.exe

Path C:\Users\Admin\AppData\Local\Temp\3dJWrwVCeYwwSuD52eSwN4sef3E\YCL.exe
Size 2.4MB
SHA256 562befc15c7530127bae89358c12bc7d902b74e747b349064c6a357cd1c49556
MD5 f1b6fe67df44f0865c707dbd39c955ce
SHA1 9b599fd3d12c55f124ff910de1b2a6f27280cea8
SHA512 5690b83914cc6d4025796bc1fe75acad257ce279b7f27ae062dfd8ae0fafdbc56f8a8bd45227ddc660395633b90006bd9c4a09f8435a625b4e7215a016f5320d
SSDEEP 49152:NxbZkNARkhxqH7VDE+46IAGHPx23n4V+bNLrwXx+sE:J2ARkhUILU34V+bNLB
TLSH
T1A3C53807D3F681D8E1FBE730CAB262735D72BC199538A65D1685CA251E30F709F29B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gsEs088VEBSt.exe

Path C:\Users\Admin\AppData\Roaming\2w8bYqsN\gsEs088VEBSt.exe
Size 581KB
SHA256 b4990aa8dd771a09af9b559f334d680d2cfce5ba8da4e5319b36720c9159897b
MD5 38f9db3db238cc16b2ad2058d53e8500
SHA1 340a3f6f9e1be33d5072b1ca1c38bd2d48a5198d
SHA512 451abc292917ca237b6e0ee2fe54cb19d5994eb8f14acc5409ee1ac3ab036bb6d1eb4ad6826068123f0f1824f81a00f2a0ac5aa15283fba301d0500ecaf27c35
SSDEEP 12288:eB+1aSSRLhQ4xPEltMibm988p3R4j4/F7hwSSSESSNHrC8:YBSM+4xPEpb2v7N1wSSSESSNLC8
TLSH
T1E0C4BE2BE7A244FDC12B40719B97A2B1A532F8250234BA6F07D9DF322E59C740FDE654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CsvkjT8rm2z.exe

Path C:\Users\Admin\AppData\Roaming\bLXA0ep\CsvkjT8rm2z.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/860-63-0x00007FF62AFB0000-0x00007FF62AFBC000-memory.dmp

Download

memory/1048-626-0x00007FF7771E0000-0x00007FF7771EC000-memory.dmp

Download

memory/1476-51-0x00007FF74DFF0000-0x00007FF74DFFC000-memory.dmp

Download

memory/1620-21-0x00007FF7EBC20000-0x00007FF7EBC2C000-memory.dmp

Download

memory/2600-13-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/3248-87-0x00007FF788780000-0x00007FF78878C000-memory.dmp

Download

memory/3752-33-0x00007FF60D070000-0x00007FF60D07C000-memory.dmp

Download

memory/4368-27-0x00007FF699060000-0x00007FF69906C000-memory.dmp

Download

memory/4860-69-0x00007FF6725C0000-0x00007FF6725CC000-memory.dmp

Download

memory/4868-350-0x00007FF657BA0000-0x00007FF657BAC000-memory.dmp

Download

memory/5240-81-0x00007FF7BD550000-0x00007FF7BD55C000-memory.dmp

Download

memory/5416-45-0x00007FF6C95B0000-0x00007FF6C95BC000-memory.dmp

Download

memory/5556-39-0x00007FF682CB0000-0x00007FF682CBC000-memory.dmp

Download

memory/5592-663-0x00007FF612BF0000-0x00007FF612C89000-memory.dmp

Download

memory/5808-57-0x00007FF710F00000-0x00007FF710F0C000-memory.dmp

Download

memory/6036-75-0x00007FF7D66D0000-0x00007FF7D66DC000-memory.dmp

Download