xbinder | 6d078ccb15e56dcefb165fe5a3a3e7288f90d932cb12081346d80b8a16ae4061

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 19:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 7.2MB
Sample260605-xvcbpsd16k
SHA256 6d078ccb15e56dcefb165fe5a3a3e7288f90d932cb12081346d80b8a16ae4061
MD5 b19bb94ca144c9fcf69eaaa3e89c5eef
SHA1 815c19495b3067a2889fe2fc06e63b37594ca622
SHA512 8507b0076beaaf29960606ff97d97ba30b4dd33a3b233797f322cd199659421c11d2a73cb9146d660127e8d613bbf8918747a6a8b9d9cc0656150d2a2b0c5f77
SSDEEP 98304:tE/RgM8LHqUOo8aH7ksUf5pLOuiFhL4nSWe7HjER9LG8ycUJ1NrSVi/lFmDZ6i:tUS7L4oBH7kf5qhLfWe7HwhG5ks+9v
TLSH
T16176331ABCA121A6F07B9A75C0D1CC67DBBDB83D7356DB5B47000DA52E722A08F39790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xbinder xworm loader rat trojan

Malware Config

Extracted

Family

xbinder

Mutex

QPUWzlnC8ratTwbLI

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
loader.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
tmp._msedgeDeveloperTask.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/408-15-0x000001C4C7340000-0x000001C4C7350000-memory.dmp	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2108	powershell.exe
1180	powershell.exe
3708	powershell.exe

Executes dropped EXE 62 IoCs

pid	Process
408	tmp._msedgeDeveloperTask.exe
4984	tmp._msedgeDeveloperTask.exe
4240	tmp._msedgeDeveloperTask.exe
3432	tmp._msedgeDeveloperTask.exe
1868	tmp._msedgeDeveloperTask.exe
4228	tmp._msedgeDeveloperTask.exe
4400	tmp._msedgeDeveloperTask.exe
4168	tmp._msedgeDeveloperTask.exe
1684	tmp._msedgeDeveloperTask.exe
356	tmp._msedgeDeveloperTask.exe
1476	tmp._msedgeDeveloperTask.exe
228	tmp._msedgeDeveloperTask.exe
2044	tmp._msedgeDeveloperTask.exe
700	tmp._msedgeDeveloperTask.exe
5048	tmp._msedgeDeveloperTask.exe
4028	tmp._msedgeDeveloperTask.exe
1548	tmp._msedgeDeveloperTask.exe
3096	tmp._msedgeDeveloperTask.exe
2460	tmp._msedgeDeveloperTask.exe
1656	tmp._msedgeDeveloperTask.exe
1388	tmp._msedgeDeveloperTask.exe
2208	tmp._msedgeDeveloperTask.exe
1980	tmp._msedgeDeveloperTask.exe
2980	tmp._msedgeDeveloperTask.exe
5116	tmp._msedgeDeveloperTask.exe
4416	tmp._msedgeDeveloperTask.exe
4608	tmp._msedgeDeveloperTask.exe
3224	tmp._msedgeDeveloperTask.exe
3972	tmp._msedgeDeveloperTask.exe
3872	tmp._msedgeDeveloperTask.exe
224	tmp._msedgeDeveloperTask.exe
2676	tmp._msedgeDeveloperTask.exe
3716	tmp._msedgeDeveloperTask.exe
2904	tmp._msedgeDeveloperTask.exe
2196	tmp._msedgeDeveloperTask.exe
2192	tmp._msedgeDeveloperTask.exe
4404	tmp._msedgeDeveloperTask.exe
1684	tmp._msedgeDeveloperTask.exe
1264	tmp._msedgeDeveloperTask.exe
1400	tmp._msedgeDeveloperTask.exe
232	tmp._msedgeDeveloperTask.exe
3168	tmp._msedgeDeveloperTask.exe
4556	tmp._msedgeDeveloperTask.exe
412	tmp._msedgeDeveloperTask.exe
4824	tmp._msedgeDeveloperTask.exe
3800	tmp._msedgeDeveloperTask.exe
848	tmp._msedgeDeveloperTask.exe
4320	tmp._msedgeDeveloperTask.exe
4540	tmp._msedgeDeveloperTask.exe
4004	tmp._msedgeDeveloperTask.exe
2888	tmp._msedgeDeveloperTask.exe
4648	tmp._msedgeDeveloperTask.exe
756	tmp._msedgeDeveloperTask.exe
2444	tmp._msedgeDeveloperTask.exe
2492	tmp._msedgeDeveloperTask.exe
4284	tmp._msedgeDeveloperTask.exe
804	tmp._msedgeDeveloperTask.exe
1216	tmp._msedgeDeveloperTask.exe
3780	tmp._msedgeDeveloperTask.exe
5092	tmp._msedgeDeveloperTask.exe
3492	tmp._msedgeDeveloperTask.exe
4764	tmp._msedgeDeveloperTask.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
4	api.ipify.org
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2108	powershell.exe
2108	powershell.exe
1180	powershell.exe
1180	powershell.exe
3708	powershell.exe
3708	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	408	tmp._msedgeDeveloperTask.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	1180	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	408	tmp._msedgeDeveloperTask.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1920	4376	loader.exe	82
PID 4376 wrote to memory of 408	4376	loader.exe	84
PID 1920 wrote to memory of 2092	1920	loader.exe	86
PID 1920 wrote to memory of 4984	1920	loader.exe	88
PID 408 wrote to memory of 2108	408	tmp._msedgeDeveloperTask.exe	90
PID 2092 wrote to memory of 1188	2092	loader.exe	92
PID 2092 wrote to memory of 4240	2092	loader.exe	94
PID 408 wrote to memory of 1180	408	tmp._msedgeDeveloperTask.exe	96
PID 408 wrote to memory of 3708	408	tmp._msedgeDeveloperTask.exe	98
PID 1188 wrote to memory of 4508	1188	loader.exe	100
PID 1188 wrote to memory of 3432	1188	loader.exe	102
PID 4508 wrote to memory of 2436	4508	loader.exe	104
PID 4508 wrote to memory of 1868	4508	loader.exe	106
PID 2436 wrote to memory of 4640	2436	loader.exe	108
PID 2436 wrote to memory of 4228	2436	loader.exe	110
PID 4640 wrote to memory of 428	4640	loader.exe	112
PID 4640 wrote to memory of 4400	4640	loader.exe	114
PID 428 wrote to memory of 2600	428	loader.exe	116
PID 428 wrote to memory of 4168	428	loader.exe	118
PID 2600 wrote to memory of 404	2600	loader.exe	120
PID 2600 wrote to memory of 1684	2600	loader.exe	122
PID 404 wrote to memory of 2516	404	loader.exe	124
PID 404 wrote to memory of 356	404	loader.exe	126
PID 2516 wrote to memory of 2740	2516	loader.exe	128
PID 2516 wrote to memory of 1476	2516	loader.exe	130
PID 2740 wrote to memory of 2508	2740	loader.exe	132
PID 2740 wrote to memory of 228	2740	loader.exe	134
PID 2508 wrote to memory of 3380	2508	loader.exe	136
PID 2508 wrote to memory of 2044	2508	loader.exe	138
PID 3380 wrote to memory of 1644	3380	loader.exe	140
PID 3380 wrote to memory of 700	3380	loader.exe	142
PID 1644 wrote to memory of 2520	1644	loader.exe	144
PID 1644 wrote to memory of 5048	1644	loader.exe	146
PID 2520 wrote to memory of 1772	2520	loader.exe	148
PID 2520 wrote to memory of 4028	2520	loader.exe	150
PID 1772 wrote to memory of 2292	1772	loader.exe	152
PID 1772 wrote to memory of 1548	1772	loader.exe	154
PID 2292 wrote to memory of 3268	2292	loader.exe	157
PID 2292 wrote to memory of 3096	2292	loader.exe	159
PID 3268 wrote to memory of 3464	3268	loader.exe	161
PID 3268 wrote to memory of 2460	3268	loader.exe	163
PID 3464 wrote to memory of 1176	3464	loader.exe	165
PID 3464 wrote to memory of 1656	3464	loader.exe	167
PID 1176 wrote to memory of 3644	1176	loader.exe	169
PID 1176 wrote to memory of 1388	1176	loader.exe	171
PID 3644 wrote to memory of 2272	3644	loader.exe	173
PID 3644 wrote to memory of 2208	3644	loader.exe	175
PID 2272 wrote to memory of 484	2272	loader.exe	177
PID 2272 wrote to memory of 1980	2272	loader.exe	179
PID 484 wrote to memory of 3140	484	loader.exe	181
PID 484 wrote to memory of 2980	484	loader.exe	183
PID 3140 wrote to memory of 4956	3140	loader.exe	185
PID 3140 wrote to memory of 5116	3140	loader.exe	187
PID 4956 wrote to memory of 1744	4956	loader.exe	189
PID 4956 wrote to memory of 4416	4956	loader.exe	191
PID 1744 wrote to memory of 2744	1744	loader.exe	193
PID 1744 wrote to memory of 4608	1744	loader.exe	195
PID 2744 wrote to memory of 4388	2744	loader.exe	197
PID 2744 wrote to memory of 3224	2744	loader.exe	199
PID 4388 wrote to memory of 4676	4388	loader.exe	201
PID 4388 wrote to memory of 3972	4388	loader.exe	203
PID 4676 wrote to memory of 2352	4676	loader.exe	205
PID 4676 wrote to memory of 3872	4676	loader.exe	207
PID 2352 wrote to memory of 2060	2352	loader.exe	209

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\loader.exe
  "C:\Users\Admin\AppData\Local\Temp\loader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\loader.exe
    "C:\Users\Admin\AppData\Local\Temp\loader.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\loader.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        27⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        29⤵
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        31⤵
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        32⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        33⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        34⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        35⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        36⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        37⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        38⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        39⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        40⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        41⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        42⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        43⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        44⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        45⤵
        
        PID:420
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        46⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        47⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        48⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        49⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        50⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        51⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        52⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        53⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        54⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        55⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        56⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        57⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        58⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        59⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        60⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        61⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        62⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\loader.exe"
        63⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        63⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        62⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        61⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        60⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        59⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        58⤵
        Executes dropped EXE
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        57⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        56⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        55⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        54⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        53⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        52⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        51⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        50⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        49⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        48⤵
        Executes dropped EXE
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        47⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        46⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        45⤵
        Executes dropped EXE
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        44⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        43⤵
        Executes dropped EXE
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        42⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        41⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        40⤵
        Executes dropped EXE
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        39⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        38⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        37⤵
        Executes dropped EXE
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        36⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        35⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        34⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        33⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        32⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        31⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        30⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        29⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        28⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        27⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        26⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        25⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        24⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        23⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        22⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        21⤵
        Executes dropped EXE
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        20⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        19⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        18⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        17⤵
        Executes dropped EXE
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        16⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        15⤵
        Executes dropped EXE
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        14⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        13⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        12⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        11⤵
        Executes dropped EXE
        
        PID:356
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        10⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        9⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        8⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        7⤵
        Executes dropped EXE
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        6⤵
        Executes dropped EXE
        
        PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
        5⤵
        Executes dropped EXE
        
        PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
      4⤵
      Executes dropped EXE
      PID:4240
- - C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
    3⤵
    - Executes dropped EXE
    PID:4984
- C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'tmp._msedgeDeveloperTask.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'msedge.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
TLSH
T119F0A2302371E1C8C9263F422C0D2A4966AF474A7B50FE0C7694635DD825167AF313F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ceceebdbd877d161f925e88d1983f280ddd0d9f053aedb0933a4ce9b0e87d56e
MD5 74b36cdea857534f335ca01cf989c95d
SHA1 17e64556a910c99db09300818cf3244a0ffd0fc9
SHA512 a608fb113e4a11c2a5ace3fe9f5e589bfae960b2fba4fa10c9ca0ab7453e3d8cbbd62b0a9a42ee43154ab359aafdb68e3c3445d7f7e7a1531152bab96366bfae
TLSH
T1A6218633B7ACC235C8D911BA208CAD11B2B5C3C7449ECE8B7B84C518A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95c41b5b327fb0805d5cf17e59e5fccfa7bd57f930c78d03d3bad7fc8fd05caf
MD5 2549daeeb07bf0c0e5874b31a420ca9f
SHA1 8eab9901e4c593166ccc63c72f4ad7e9ca51cbb0
SHA512 5497d6cd9a332b4381e7b5f1c1edfd57f33c9b8f9556ef4b95c306547441363bb96e08c0fdaf045cad4ea88320c4766c9656fe0da9d753a2f1e33f927bb102ca
TLSH
T1E7218933B79CC134C8D9117A108DAD01B2B5C3C7449ECE8B7B84C508A57F999DB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qzylmzhd.xav.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzylmzhd.xav.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp._msedgeDeveloperTask.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp._msedgeDeveloperTask.exe
Size 205KB
SHA256 df01604611385cb4e2d06522e9499811664f56257cce2ca04384709f369c9a32
MD5 5fd2985760e27783bd8545b990f6469b
SHA1 88808aad44dfd559511a899edaff7b0b6de20c07
SHA512 04554ec45656d3f1eba9b9c138aa8e6751f0e3c07b34298bb4bedd735a34e7d903c821e5ae5125d6452f1834ab39b6d889087d272a20378f894f9f359c9cdfa3
SSDEEP 3072:HKkDPO6stRt82KuvBs5ZDvjYjChtRS2fXv6SSdkW4kVl5pWbSGYdPQUL3McNyl:XrsjKu5s5xMKlpy95pWbSGYdIUbBNA
TLSH
T181249E5BB56535FAD1A78C39C4A22B06DF71BC725F705BCF47800AA62E12AD09E3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-15-0x000001C4C7340000-0x000001C4C7350000-memory.dmp

Download

memory/1920-13-0x0000020DE8C30000-0x0000020DE8C40000-memory.dmp

Download

memory/2108-30-0x0000019736110000-0x000001973612C000-memory.dmp

Download

memory/2108-35-0x0000019736260000-0x000001973627A000-memory.dmp

Download

memory/2108-38-0x0000019736250000-0x000001973625A000-memory.dmp

Download

memory/2108-31-0x0000019736130000-0x00000197361E3000-memory.dmp

Download

memory/2108-32-0x00000197361F0000-0x00000197361FA000-memory.dmp

Download

memory/2108-33-0x0000019736220000-0x000001973623C000-memory.dmp

Download

memory/2108-34-0x0000019736200000-0x000001973620A000-memory.dmp

Download

memory/2108-23-0x0000019735EA0000-0x0000019735EC2000-memory.dmp

Download

memory/2108-36-0x0000019736210000-0x0000019736218000-memory.dmp

Download

memory/2108-37-0x0000019736240000-0x0000019736246000-memory.dmp

Download

memory/4376-0-0x0000020BEFF40000-0x0000020BEFF50000-memory.dmp

Download

memory/4376-3-0x0000020BEFF40000-0x0000020BEFF50000-memory.dmp

Download

memory/4376-2-0x0000020BEFF40000-0x0000020BEFF50000-memory.dmp

Download

memory/4376-1-0x0000020BF0E30000-0x0000020BF153C000-memory.dmp

Download