951243678b0d4ff9269bccd1f5775c6764012b99071f31df71b17b4be8dbf50b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tm2027-v0.2.1.exe
Size 17.0MB
Sample261006-vm2waa1x3j
SHA256 951243678b0d4ff9269bccd1f5775c6764012b99071f31df71b17b4be8dbf50b
MD5 1b93c430bb22e0fca5822abde14f8e7f
SHA1 6899a2cab72defe64e69b7ddb9a0a969efaa505e
SHA512 c5a1184683f1cce1b3b1d5b1d550ac7dc4bb4966fa564594d9c6a0f1d791001f974fa0f9f1e7d526a67d59be7cc5cb882cddf691dd30873a68fb2e103f346a05
SSDEEP 98304:EmrVRymiZQUh+UVOg7Va/B1QbOqsuE6S+pwXJ4C8gTZeKCJI+PS2pCwLkuYz226P:JRyPFOqsujWZR+PTpCJNz2dqSwz9
TLSH
T1CD074B51E69F99ACD05BC8B0C3079A774E2534CB1A26B9BF41C4553C3FAE7E05B2870A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
1916	herdr.exe
4728	herdr.exe
3324	herdr.exe
3932	herdr.exe
4808	herdr.exe
5216	herdr.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3360	powershell.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\URL Protocol	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\ = "URL:tm2027 pane activation"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\tm2027\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tm2027-v0.2.1.exe\" \"%1\""	reg.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2160	reg.exe
4156	reg.exe
4128	reg.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3292	tm2027-v0.2.1.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3292	tm2027-v0.2.1.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2160	3292	tm2027-v0.2.1.exe	89
PID 3292 wrote to memory of 5008	3292	tm2027-v0.2.1.exe	91
PID 3292 wrote to memory of 5972	3292	tm2027-v0.2.1.exe	92
PID 3292 wrote to memory of 4156	3292	tm2027-v0.2.1.exe	95
PID 3292 wrote to memory of 4128	3292	tm2027-v0.2.1.exe	97
PID 3292 wrote to memory of 3360	3292	tm2027-v0.2.1.exe	99
PID 3360 wrote to memory of 2308	3360	powershell.exe	101
PID 3360 wrote to memory of 1404	3360	powershell.exe	102
PID 3360 wrote to memory of 1916	3360	powershell.exe	103
PID 3360 wrote to memory of 4728	3360	powershell.exe	104
PID 3360 wrote to memory of 4748	3360	powershell.exe	105
PID 4748 wrote to memory of 4076	4748	csc.exe	106
PID 3292 wrote to memory of 3324	3292	tm2027-v0.2.1.exe	107
PID 3292 wrote to memory of 3932	3292	tm2027-v0.2.1.exe	109
PID 3292 wrote to memory of 4808	3292	tm2027-v0.2.1.exe	111
PID 3932 wrote to memory of 5560	3932	herdr.exe	113
PID 3932 wrote to memory of 896	3932	herdr.exe	114
PID 3292 wrote to memory of 5100	3292	tm2027-v0.2.1.exe	117
PID 3292 wrote to memory of 5216	3292	tm2027-v0.2.1.exe	118
PID 3932 wrote to memory of 3416	3932	herdr.exe	121
PID 3932 wrote to memory of 1692	3932	herdr.exe	123
PID 3932 wrote to memory of 3064	3932	herdr.exe	125
PID 3932 wrote to memory of 4544	3932	herdr.exe	127
PID 3932 wrote to memory of 1500	3932	herdr.exe	129
PID 3932 wrote to memory of 2720	3932	herdr.exe	131
PID 3932 wrote to memory of 1372	3932	herdr.exe	133
PID 3932 wrote to memory of 3552	3932	herdr.exe	135
PID 3932 wrote to memory of 2032	3932	herdr.exe	137
PID 3932 wrote to memory of 5016	3932	herdr.exe	139
PID 3932 wrote to memory of 2216	3932	herdr.exe	141
PID 3932 wrote to memory of 3344	3932	herdr.exe	143
PID 3932 wrote to memory of 5804	3932	herdr.exe	145
PID 3932 wrote to memory of 5972	3932	herdr.exe	147
PID 3932 wrote to memory of 3448	3932	herdr.exe	149
PID 3932 wrote to memory of 6096	3932	herdr.exe	151
PID 3932 wrote to memory of 2052	3932	herdr.exe	153
PID 3932 wrote to memory of 4852	3932	herdr.exe	155
PID 3932 wrote to memory of 2364	3932	herdr.exe	157
PID 3932 wrote to memory of 4960	3932	herdr.exe	160
PID 3932 wrote to memory of 6052	3932	herdr.exe	162
PID 3932 wrote to memory of 5020	3932	herdr.exe	164

cURL User-Agent 28 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	16	curl/8.8.0
HTTP User-Agent header	20	curl/8.8.0
HTTP User-Agent header	23	curl/8.8.0
HTTP User-Agent header	24	curl/8.8.0
HTTP User-Agent header	27	curl/8.8.0
HTTP User-Agent header	28	curl/8.8.0
HTTP User-Agent header	29	curl/8.8.0
HTTP User-Agent header	25	curl/8.8.0
HTTP User-Agent header	30	curl/8.8.0
HTTP User-Agent header	31	curl/8.8.0
HTTP User-Agent header	32	curl/8.8.0
HTTP User-Agent header	36	curl/8.8.0
HTTP User-Agent header	38	curl/8.8.0
HTTP User-Agent header	42	curl/8.8.0
HTTP User-Agent header	44	curl/8.8.0
HTTP User-Agent header	13	curl/8.8.0
HTTP User-Agent header	21	curl/8.8.0
HTTP User-Agent header	26	curl/8.8.0
HTTP User-Agent header	33	curl/8.8.0
HTTP User-Agent header	34	curl/8.8.0
HTTP User-Agent header	35	curl/8.8.0
HTTP User-Agent header	37	curl/8.8.0
HTTP User-Agent header	40	curl/8.8.0
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	22	curl/8.8.0
HTTP User-Agent header	39	curl/8.8.0
HTTP User-Agent header	43	curl/8.8.0
HTTP User-Agent header	12	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\tm2027-v0.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\tm2027-v0.2.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Classes\tm2027 /ve /t REG_SZ /d "URL:tm2027 pane activation" /f
  2⤵
  - Modifies registry class
  - Modifies registry key
  PID:2160
- C:\Windows\System32\wsl.exe
  "C:\Windows\System32\wsl.exe" --list --quiet
  2⤵
  PID:5008
- C:\Windows\System32\curl.exe
  "C:\Windows\System32\curl.exe" -fsSL --retry 3 --connect-timeout 10 --max-time 120 https://herdr.dev/install.ps1 -o C:\Users\Admin\AppData\Local\Temp\tm2027-herdr-install-3292.ps1
  2⤵
  PID:5972
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Classes\tm2027 /v "URL Protocol" /t REG_SZ /d "" /f
  2⤵
  - Modifies registry class
  - Modifies registry key
  PID:4156
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Classes\tm2027\shell\open\command /ve /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tm2027-v0.2.1.exe\" \"%1\"" /f
  2⤵
  - Modifies registry class
  - Modifies registry key
  PID:4128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tm2027-herdr-install-3292.ps1
  2⤵
  - Enumerates connected drives
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" --fail --silent --show-error --location --connect-timeout 30 --speed-limit 1024 --speed-time 30 --proto =https --tlsv1.2 --output C:\Users\Admin\AppData\Local\Temp\herdr-manifest-7b6cde08dad5425cb60f148a9db8f0c3.json -- https://herdr.dev/latest.json
    3⤵
    PID:2308
- - C:\Windows\system32\curl.exe
    "C:\Windows\system32\curl.exe" --fail --silent --show-error --location --connect-timeout 30 --speed-limit 1024 --speed-time 30 --proto =https --tlsv1.2 --output C:\Users\Admin\AppData\Local\Temp\herdr-install-3711bc78057c4d16842cc235c8ba8b3b\herdr-download.zip -- https://github.com/herdrdev/herdr/releases/download/v0.9.3/herdr-windows-x86_64.zip
    3⤵
    PID:1404
- - C:\Users\Admin\.herdr\packages\standalone\releases\.staging.0.9.3-x86_64-pc-windows-msvc.3360\herdr.exe
    "C:\Users\Admin\.herdr\packages\standalone\releases\.staging.0.9.3-x86_64-pc-windows-msvc.3360\herdr.exe" --version
    3⤵
    - Executes dropped EXE
    PID:1916
- - C:\Users\Admin\.herdr\packages\standalone\releases\0.9.3-x86_64-pc-windows-msvc\herdr.exe
    "C:\Users\Admin\.herdr\packages\standalone\releases\0.9.3-x86_64-pc-windows-msvc\herdr.exe" --version
    3⤵
    - Executes dropped EXE
    PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1plxnne1\1plxnne1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB46D.tmp" "c:\Users\Admin\AppData\Local\Temp\1plxnne1\CSCF6731248328D4736B1DBF43941B5D540.TMP"
      4⤵
      PID:4076
- C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe
  "C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe" --version
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe
  "C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe" server
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/index.toml
    3⤵
    PID:5560
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 3 --connect-timeout 10 --max-time 20 https://herdr.dev/latest.json
    3⤵
    PID:896
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/amp.toml
    3⤵
    PID:3416
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/antigravity.toml
    3⤵
    PID:1692
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/claude.toml
    3⤵
    PID:3064
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cline.toml
    3⤵
    PID:4544
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/codex.toml
    3⤵
    PID:1500
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/cursor.toml
    3⤵
    PID:2720
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/devin.toml
    3⤵
    PID:1372
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/droid.toml
    3⤵
    PID:3552
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/gemini.toml
    3⤵
    PID:2032
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/grok.toml
    3⤵
    PID:5016
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/hermes.toml
    3⤵
    PID:2216
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kilo.toml
    3⤵
    PID:3344
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kimi.toml
    3⤵
    PID:5804
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/kiro.toml
    3⤵
    PID:5972
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/letta.toml
    3⤵
    PID:3448
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/maki.toml
    3⤵
    PID:6096
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/muse.toml
    3⤵
    PID:2052
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/opencode.toml
    3⤵
    PID:4852
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/pi.toml
    3⤵
    PID:2364
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qodercli.toml
    3⤵
    PID:4960
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/qwen.toml
    3⤵
    PID:6052
- - C:\Windows\system32\curl.exe
    "curl" -sfL --retry 2 --connect-timeout 5 --max-time 15 --max-filesize 262144 https://herdr.dev/agent-detection/github-copilot.toml
    3⤵
    PID:5020
- C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe
  "C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe" api snapshot
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System32\wsl.exe
  "C:\Windows\System32\wsl.exe" --exec sh -c "s=''; if command -v subs >/dev/null 2>&1; then s=subs; elif [ -x \"$HOME/.local/bin/subs\" ]; then s=\"$HOME/.local/bin/subs\"; fi; if [ -z \"$s\" ]; then printf 'the subs aggregator is not installed here\n' >&2; exit 127; fi; exec \"$s\" 'list' '--json'"
  2⤵
  PID:5100
- C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe
  "C:\Users\Admin\.herdr\packages\standalone\current\herdr.exe" --version
  2⤵
  - Executes dropped EXE
  PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

herdr.exe

Path C:\Users\Admin\.herdr\packages\standalone\releases\.staging.0.9.3-x86_64-pc-windows-msvc.3360\herdr.exe
Size 25.1MB
SHA256 d12a5a55f5b3668dba8366eda8580075bf0b78201b0112df6b7234fa005a2b0d
MD5 99d241ae24ba917f8f32b87094a1fde9
SHA1 d0a3a150e1e117476da74c3eb073fc72c6788e7d
SHA512 8e852fc3f40bdf33a1dcb25819a5e495e5a4dd0afcb3ec61bcdf3be4085341310b9370fbce06504404b92cfd706ff0d5641ac080b7d89433df914b7e44c067b9
SSDEEP 98304:UB7QwC2ocTeUGFxviFDWVW6X41CZX7MeNuy84GXk3ZGJep8XMcsDH+qVzElRJgwD:O7k9USzn9FoXYEMOwRkt0EFCW
TLSH
T15247F601BB9E995CD15BC8B4834A4B334B7530CB1A35B9BFA0DC55752FEEAB41A38318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1plxnne1.dll

Path C:\Users\Admin\AppData\Local\Temp\1plxnne1\1plxnne1.dll
Size 3KB
SHA256 1424434afee81e3fb88acfe60b94019e680bd2d1903571923d0807171ae98337
MD5 933caaa12365a23ed3a835f3137d9bdf
SHA1 6c11284d3d9f1f6be5ada75136a9c70fccf934f8
SHA512 7b29f79ecc30452ee117f3523149b91cb398cc23d74919bf1e6926aa7a39b9135a9937dcb6099da3c4d7c00b080f086e99940704dcc14ed893b925945cfe869f
TLSH
T11371CE5AABE8462BE4B707346EF3432727B4FC605F72976E19811218AC206645D72BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESB46D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB46D.tmp
Size 1KB
SHA256 59095613d1f70a4c75f7c1ee35bc43bbdaf8a7a5f5018c5b8ea00bbcc9413492
MD5 ef96cac807e6dfeffc6202071dddac4a
SHA1 5997afccdea9fc5916841983c3aac00f91d03f81
SHA512 d5ab182c19ffa8322ec68998c8bb6522438bae7d07feafe574e88c9abc40b2d0526e8c9a4dbefff9ce72d10866f3b8067e8b6669f494e8d9e1bd41e4f151356a
TLSH
T17B218C0563EC471EF073573169F6172FA278FD64EF62A76F844102282C51504DEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lxxlxp2v.2d1.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxxlxp2v.2d1.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

herdr-download.zip

Path C:\Users\Admin\AppData\Local\Temp\herdr-install-3711bc78057c4d16842cc235c8ba8b3b\herdr-download.zip
Size 9.4MB
SHA256 c75b1fa49f7a3ba4b8b11789912a6147e4214a3b6fd3556d0f80076c8887d795
MD5 4d35a5713688fc1c044512dfa90789e6
SHA1 e51e248b9c1019910a0e429366868a86b25fcb42
SHA512 8818e9d2d6bab4e4b419756d626a874e2f96502975bff2685237e5cc271105a2a7cef4643e31e0f6049eba422f2ad78abb3a9056e9e071eec559f4403701874c
SSDEEP 196608:Z0iSpUVd+og944xp26LqIbGMHDZMqh9JPbpsXbmFre5UQnaCT7JLaf:yiS8CiqpTLqItF7jP1wbSr1xQNm
TLSH
T1BBA63340276F7903AFAB5354CFD8D0676DE859CB1566E1974E7029F0CB60EAB82CA370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

herdr-manifest-7b6cde08dad5425cb60f148a9db8f0c3.json

Path C:\Users\Admin\AppData\Local\Temp\herdr-manifest-7b6cde08dad5425cb60f148a9db8f0c3.json
Size 173KB
SHA256 daad8d6fe4524fbb78caa287b7936a6a7400262dbe872c8bc3532c3b371bf05e
MD5 266c69dc63d5a3e8cb521156be17ad4d
SHA1 40506dfaaf3de91920006f8f1ac5b0f262227906
SHA512 1c1145e5c29cd1ef6540b3c486d47ff85d401917af63e541401942eff679456eccf26abac85990eaa78403824de96ffca341c7e3c6c95ebc3a76bdf0abfdaafb
SSDEEP 1536:/q1Q6Hj+VubNU02/aM1LrJ/1seIs2UxYXfMX4Ok3El+gAJbPLJ0uCG5PXtR:y/bZ2/aIvJ/1shscr3BVFPSG5PXtR
TLSH
T12C04D827B22027BF0B422262924E6179F727867EA7177E71F07E4A1C530949E533B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tm2027-herdr-install-3292.ps1

Path C:\Users\Admin\AppData\Local\Temp\tm2027-herdr-install-3292.ps1
Size 33KB
SHA256 369e0d2b5a5f976e11b512f3c4b610a2eba6119732b292a2f587ca8f80fe0baf
MD5 e788058c2eeaba804514ce78bb52ad71
SHA1 a6902ed8f6b8fb334e42a37b6b3efef532083cd9
SHA512 c20c8c0c87d88498abd00b1a2c595643d7ca6d4f58b13fc92f18f0a196717ae3caefc3bef02e4ee6985bfda65773a79c7c6523dd5bfcd21fe8517b1f871b9aae
SSDEEP 768:FgyDfJnQ1oIC5/yz0ODhEEbsxm8vrVDDftVW0mKWh:Fgy5JyzHhPsxmYZVVW0y
TLSH
T13FE2C81935E044A102C726AA5CEE51447A2D421F802DAF24FDFCA3C4BFB653C87B576A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

agy.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\agy.toml
Size 2KB
SHA256 c25fc6bae935b7582d707120915287b52d39bf81b5ab3f368cd688739c6e0325
MD5 8cbb6ad3d8e91b8592a53ba979c82981
SHA1 846a2958738a873e79535f4deebf72d676a33e6d
SHA512 da77a7464d97a206b15593e9273a81f99bec23cd0dbe6b03bdc6b39b8e778a3eb3c5e24ed027c0a4d3a0191b0d0fe3f0d0806325e5e320a67b0400691d67d5e6
TLSH
T1B441333AD25C27BA4AB1E90066DFDF919579B039B3521438F11EC005338E5E0D2FDAB1
MD5 SHA1 SHA512 TLSH

Submit Download

amp.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\amp.toml
Size 1KB
SHA256 b5806b0dd21e2f5e752d0eac7f084d5ce2e3f275638cfd1234c42cc88152dc8c
MD5 a1a29046e84462cf6effcb9f44165dce
SHA1 b561778c774a6a4c5d253240db9bc8177b07d731
SHA512 251470761184afe642c2fc4d24c45e121a63183a72d67f448bf4ed4cb6b95904a72e922f7ec0d68677b7c3b4582488dda7148d9e82a9fc5ffe04797c32f9c6db
TLSH
T16C31ACB586B03A2D49D1F68C86874E001B74F1A8E2D02C187AD7C04527ADEA4D3FEA74
MD5 SHA1 SHA512 TLSH

Submit Download

claude.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\claude.toml
Size 6KB
SHA256 038d0aa23fee3f9b39cb3c9ca117d0f95b0b3a5873cf0f38284ccbac279c9664
MD5 dc51f619784c2f6e34d4f3bd7aaec891
SHA1 40fee17fb77ecc2f2374a898ace569fb6b63ccc3
SHA512 de103a948fc707126634665fa135a0a4b039f16e601d3db28b68c68e63592c2d88a8dd3e3c216b0ce531a6498bc78800d56ed4c200f60bc0fbdf151ea847ae89
SSDEEP 192:7q147hyXMhS4WrBohRHplqyfGt7s+q92/5SPfNKjrQdIFHkcqHeFHI:7q29+ipWdwJRfs7/i48fNCaOEcBm
TLSH
T106D1FFB982F42A6D4452F99857CB5A504730F029F7902D18B2CAD04723DA9ECD3FBAA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cline.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\cline.toml
Size 1KB
SHA256 75fe33ec735c59638da8d62e16bddd257d9959e692edb83b1f11b7f28057866a
MD5 6bce339906c2227b7c651f6fe46acf8d
SHA1 d2b4a10c1526eb686c88888f9daa57c4c0539668
SHA512 a3f7ba4cf15d35d73be4ab55e3a38509f84b60d5a9b9354b7a8f463c9b4265d67289e9b5b6443e2a55d5c9b5f871be156ea461011b28100b8602cad21438349b
TLSH
T16E31AC75C7E4367E85A1F6486987DD801730B135E18118ADB2E6C506228E2D8E7FEF70
MD5 SHA1 SHA512 TLSH

Submit Download

codex.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\codex.toml
Size 3KB
SHA256 da6d6084e3ac84975caac79bef237b23b1801aba8ec7efc9266ab127f1a794e6
MD5 83f302fa386c9fa661f0c54e529a3c0f
SHA1 42de90aa8101734e65286f44237713c2474a6591
SHA512 af8caee707136c7d4083a69bddb03e9b8b2ffd3c1feadce179772edf755aeefdb22eb4fd6c576f7689866a47fbe2480ebebd24af2e4192ac5404f1fa571e0df6
TLSH
T11E8155B946F9186C4482F0DC878B99600A71F499F3D0191972CFC845239ADF8D3FAAA5
MD5 SHA1 SHA512 TLSH

Submit Download

copilot.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\copilot.toml
Size 1010B
SHA256 b70c652584326a1a98475a5fcef16207dee9f23b65f8e78300f4fc2bb578cb11
MD5 a2c87070760a71a19333cdbaa69a475d
SHA1 655186cf6d1b14dde908074aa8628da15df685a3
SHA512 c0afe6d4879727835e8f546c553a5ebbed7141d11842b75de0c2335293e893c18803da7566ba9f681094aba52ff4f42ca152164c89210aec5e5dfec1d7b7edbd
TLSH
T1321129F846F0699D4892FA9459CBCE120360F058E6D12C5C329A9083278A849D2FB9A4
MD5 SHA1 SHA512 TLSH

Submit Download

cursor.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\cursor.toml
Size 1KB
SHA256 753b1f7f632d42fa21139c2767ecbb5e1078748aba2e59407ac4932d3ce36ad7
MD5 4b1ef2a20b4510e6f91ab1789282872e
SHA1 e934c83d7e670dbabc54a16e1d39c8a52e6940dd
SHA512 4a6e2431d078c2111e2c18d335cf6a7b9896c9ca6d7aee1be9a0d6035c6b264785015c840a978be6068a8cf74394e1bbdad2a7d3f706b9f4e8c7728b05eee6f8
TLSH
T1D531ED7482F4797E85A2F4980A87CE004670F138D2822C08B287C48627DEACCC3FEE75
MD5 SHA1 SHA512 TLSH

Submit Download

devin.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\devin.toml
Size 1KB
SHA256 250c9cea1d60bdb965dc6056f3066b785e941d60242756fbaca73b57ca6b0f85
MD5 f5b11eb8a8ccbf7e1079afbf47afea7d
SHA1 06951c20489dcbc9ee44c340acc05520cbece3ad
SHA512 f0cb56f08adb837628936291dfa2f7e4aea4cbd33c7ca33302264554059203beaa79fb8443b47ae66359c2832bf8b4fa265b35e05310293056419511deba22fd
TLSH
T14C414D3CD958297E5DA1F98C558BCD815770B528D1912D6C628BC28112CEA64E2FFEB0
MD5 SHA1 SHA512 TLSH

Submit Download

droid.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\droid.toml
Size 1KB
SHA256 d37e7c464177c0e8f3edce8d4fabc4bcc7a1874edf2c4c87a2f927888cf69ce9
MD5 51ec902ad1e56e37c5534b8de4425ae6
SHA1 ada0aa51271bd0be0ad1531acff542cd8c15e948
SHA512 aceb9cb70a49088c88a51fb5822087e70bc67f0620ca4ba5771c911a4f28bb72a63e8dd6ca45c35daf64c1aa2502ee11375060de9e9648204573e89e67aea031
TLSH
T114117F7546B43A7E88F1F5444CDB9E910A65F118E3810C6872DBC146328D9D4D2FA965
MD5 SHA1 SHA512 TLSH

Submit Download

gemini.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\gemini.toml
Size 700B
SHA256 d7013b5e772852ecc595febf964f00b4f9edcbc6047a2a5421613a154d92520d
MD5 419444d4daf4ef9d3894f7b6ca1226ac
SHA1 1ae3d8b31847af2c1b01e13a00f5836b6309e4e3
SHA512 2d3711ca4b9b2244ef4aca210c192f01ca2fe1f2501243d06142318201fadac3a3100c9366b4b4a5beb82ec4b696c329955dbf0ca99380d33666b28da6ee16fd
TLSH
T184017BB483B5797E5881F68845876A120771F024F3811814B3A7C0892B9C5A8D3FB936
MD5 SHA1 SHA512 TLSH

Submit Download

grok.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\grok.toml
Size 4KB
SHA256 8db7a8de4cd782fce26600859d78db7167399feb4c76f303104bc1bb83ab602b
MD5 40de4ad28e8d82ebb8f4f084c184ff04
SHA1 295538293581ce90dcaccc82dfb805bbd96fc74b
SHA512 1641e1073c67ac5fa32cccb3b03916cc45813c4463f54c26f7ebdb9a4d2918109d9525488d7154133bcb6db35bad9b2715d379cf97141fd0c1f2a187ded9f0a6
SSDEEP 96:6V3ejnxLFEVyHN84ZojoI0g0L+1gg+JSDg3Zug97KDgz/ng/13J4P1191a1r2+4F:6onVFEVL5jZ0l08SDQutDugtql1c2FkG
TLSH
T18CA155748768267E4D92F144659BCE402A74A128E3C51C38A1AAC145B35EEF8D3FDB72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hermes.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\hermes.toml
Size 2KB
SHA256 533d21b65dea3a0c60c25d0475c9c900d28a5712b6392669a7788f75de2b6e85
MD5 c3b34996d5a8a83f7b53a06f190d4343
SHA1 4d6b7342684cceb191a36c8654677c2484cc1527
SHA512 ae107991060f6dca55e89f58c4c6eb286d7ff11c2eece81740fb251d42fcdf1d5149ec932954c7d35a7cb8c203ff78c27f2d5cfb322ab3caf756d531f2ae9f42
TLSH
T12E51AEB5C5A92D6E0992F58C59878E120730F069E2910D187187C0972BDAEE8D3FAA64
MD5 SHA1 SHA512 TLSH

Submit Download

kilo.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kilo.toml
Size 694B
SHA256 70f0ba4e58bc141fe69d7024013f973cd16e8616393079318914d70afeefef3b
MD5 881e91480c96c6376acf3f6a625575e5
SHA1 901ebda9aa8514d406b9c4f5307a72f267efacbf
SHA512 bae35942b7901dd135d208e8f65fcaba972746cfabede421049bd04c955ff30312b5d0760db3da31dc04f76fb569c2112f575fd2ba87ca9c8bd200544a0cb762
TLSH
T1C3017B764AB13D7E0441F98454DB6E130720F014F2C0485833EBC5861ACDD94E6FE979
MD5 SHA1 SHA512 TLSH

Submit Download

kimi.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kimi.toml
Size 1KB
SHA256 ede08c0d2d5024f7606dc0a1b2f7a9c6a0ebb99f3b6c58ca6757049856d06e05
MD5 dfd297109ebaf3f38c7fef8b11abf7f7
SHA1 7b23f7d7e051a8ca470fd2ffa4df214dd95a9743
SHA512 1dece1245616bc12e95df5727d0e6d63f785ae9091e4bb737dabe1d85a9b512c2902e2979230796327f380d01664df52bef725074ec1af9208bbc5353399f1c1
TLSH
T12B4188B146B02E3E8496F69C1A976E015A70F130F2811C5872DBC18523499DCE7FAA79
MD5 SHA1 SHA512 TLSH

Submit Download

kiro.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\kiro.toml
Size 2KB
SHA256 c8990f3c9d4810995be97e8df29836411e37d90f6ac9d9303f505787b504806b
MD5 05281f1b49a4bbfe8b6b82615a074d66
SHA1 4bd8406b4ac994b3c46e85b3e00f5011f20d47af
SHA512 ed62e5db638b6bafa33627ce91ad88ef340be59b67a9c110abff53fc206e7a757e29edec02ef5723454aa235975a4543d6cc4fe955e352a38f1f3948e2bcb6ae
TLSH
T17F51323891E4607D9C90F9AC6B019A841FB0101DF7C32814F29FD615AB6DEE857BE639
MD5 SHA1 SHA512 TLSH

Submit Download

letta.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\letta.toml
Size 2KB
SHA256 205b8c135584c86f9f529aa2d061109b5129085cc5c3124c6dbfe0e78fcdba43
MD5 02b70ac7c41981214318084a30d95ec4
SHA1 2885cf209ef4112e234c36a9c6fd4c9b960dc2db
SHA512 9614854e82c0bcdee6557a21f89741f64d92231419b03cbfdc417478354252839d249a970000b2844fc5eab1e599778acb1b40e65bec2dbed636c736a9aacb5b
TLSH
T19041CB35D7286DBE4EB1F848AB86CD501B702078DAC11D69A39AC110312B6F8D3FE776
MD5 SHA1 SHA512 TLSH

Submit Download

maki.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\maki.toml
Size 1KB
SHA256 3b392170ee3082051266509f575a4640bde8d693b2f37ecf52157a641bc75b28
MD5 d2ba8e27944a4eae11e743afc884061f
SHA1 cdfe06e37919034ef6c2189f5e85a1a70fe858d5
SHA512 7aac443abaf07554c4a24905bf5bbf43a61df55191e7a6e363c9c79a974d2b6d8359a32d42b5e0007124b94cf7e15b7303e12ae1eab1ed440cbdbe89d637c150
TLSH
T1E341F27546941B7E4852F684B28FEB904A31F228E6911864B5CBC18113857D4D3FEAF4
MD5 SHA1 SHA512 TLSH

Submit Download

muse.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\muse.toml
Size 3KB
SHA256 b69c4d87fa9c19e3e6453b706fbe39c98a8b33ffbaa48e8cd5ae6751e9615074
MD5 8523528d2314b8fb4aa3c3e1c15fd54e
SHA1 b7ba7f1f1c7e39eb5718565f3f6d5a08e2827ca8
SHA512 b9da5abd9d269d3e333f439fcdf65719b63229db5674b5396405f06689cebd759e56c7eaca349ffbf3057e2cf1df228ad4930d2c49ad5534e5b09357cee83eff
TLSH
T1CC71FC79A7E53A5A48A5E0C4A687CA716734F43C72900C25709EC1A613CFAA4D2BFB61
MD5 SHA1 SHA512 TLSH

Submit Download

opencode.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\opencode.toml
Size 1008B
SHA256 faa82aed2d76ad856528caae04232894594b74cc903aed3e522b3e725c5f2c95
MD5 4cb44d1562c84e6caded2bd0506cdeb3
SHA1 0e68d554bfe11a27ad01343be0f3eab5ba472d67
SHA512 c8cff434c9adfd4e64a78eb61b5eb00f55d59182d1f243379923606b5f35bafdb63162fee3498c04999e5c772e0faf266db454a2ae07dcc91f2ba9ae09667fc0
TLSH
T189119EB446F12D7E0892F5C82597AE211730F058E2C01C18379A80D217CBDE8EBFA679
MD5 SHA1 SHA512 TLSH

Submit Download

pi.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\pi.toml
Size 624B
SHA256 949f5f3bcfeb6db1261432697dd94a9ed625a733d70c00e6fc0910372fad7c66
MD5 a1dd15ad7da547f56162e91e38f4d4da
SHA1 6ffb0228c57721c127f4ea53fa76f6ef495f2096
SHA512 49ecd3167877a1f062e76cbb9e7eed17a95aa87908145f44c8cee4c44c61e1b66ba56cc7d3bd49294bb7231b3ac903615517b1d0f4c85091c14b1db67bd85106
TLSH
T1B7F028B589A8AE7D10D4E604AF43AC140BB43475F7C10D2B73D5890021581ECD7FC235
MD5 SHA1 SHA512 TLSH

Submit Download

qodercli.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\qodercli.toml
Size 1KB
SHA256 2089f70fc78c6576fd7128a00f4e7eedb85be81bde9ed73301b3b88000048961
MD5 c4fdf3c6dcdcf8f48e41d10f2efefd4e
SHA1 66412eea7554513689c6ad430619cdc73f59156c
SHA512 f7de519f88bc49b08e6bfc239d968546e80f7915c76b08317a7885feea89d22b14c2009aedc69fb1fa14606a715b23e0fcf342c71c159cf5e884237aaa14594e
TLSH
T1641127B589B9793E4496F29C199B6E110AA1F154F3C10C5836E3C0891BCE998E3F7A3D
MD5 SHA1 SHA512 TLSH

Submit Download

qwen.toml

Path C:\Users\Admin\AppData\Local\herdr\agent-detection\remote\qwen.toml
Size 3KB
SHA256 b27aa456af228e8a4ceac74f0dd431c33b21473b69314fc672a7fba474e2a7fe
MD5 04e31de294ec223f1ed3a0a9c41a6f00
SHA1 edc2306f43a76b3e7db8a7bf6a00503acb96f6eb
SHA512 96fba7dc28afa535af906735ea9d337334872ff672a62be8f8a22252109baa94493bc1880806408c405093393b1c7e7bd05df955878ba1ca412af64d45a46f54
TLSH
T1546131B5C1AC7A6E0996E45879878D411B30B474F2D2286C6187C04233DE6DCC3FEBB6
MD5 SHA1 SHA512 TLSH

Submit Download

1plxnne1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1plxnne1\1plxnne1.0.cs
Size 490B
SHA256 fe4557767a3de2a921e82d26350e20692cb1b9437c320607f06f360b112f116c
MD5 4920871c52db608574f0c54d6eaf6fb2
SHA1 34500135fc1243e0ac6b89c6a10d50ba9207fb1d
SHA512 315b3c6c2bd62fa097f03643608f38a6b1f6ce4e4d11f7441eaa0a93e74c9ca08f73bae361eeadf0e652c1f878a24c97ee1e79c5c7e1e7ae86c17e71e3802110
TLSH
T1FBF0E93497DB986A01C1501B1C9DB4D4BB3393271565B801FAEE1211CF8F94C2732725
MD5 SHA1 SHA512 TLSH

Submit Download

1plxnne1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1plxnne1\1plxnne1.cmdline
Size 369B
SHA256 2de7329154d13b3fb3fd373e1f5af437ac89cbb18e622eec10e9dfab9cfe02ba
MD5 923dfe1d2157380d7c2fcb5750f0a439
SHA1 81c3f5cce0acb413dbfecffc03b005736fbbb7be
SHA512 cfcad21f8c763b9b47d6df01fc9088eeb5164e32bc26bb4379238434ce782ce54128cf9106e23ad9022fca0f430d72985f3b155e751a93cb5fe98ff13064979c
TLSH
T139E0D83B925AC67D19D930072369C5AC877206673A817F995350845DD0370286BD2755
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF6731248328D4736B1DBF43941B5D540.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1plxnne1\CSCF6731248328D4736B1DBF43941B5D540.TMP
Size 652B
SHA256 818337cb59a0655915f44eec1f363114d27eee4bd95216ebf19329d24df44c72
MD5 f420efd19872746b33377ababbefd5fb
SHA1 be184567baa448efb9e81f84328a7f6f5f8fbba6
SHA512 2406f25630e6437547053dd6a4fdeecd6ab15e4ae3f6a986d11530af881b79d62de6698f0e85e67583af5c32b8eff5f8554d7817e4619c53c8a055e8af8cb161
TLSH
T13EF0340A73FC021AF0F34B30BDF643A7A1ACBC64DE3293ED1881031928645148A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3360-22-0x000001C261C20000-0x000001C262148000-memory.dmp

Download

memory/3360-10-0x000001C260960000-0x000001C26097E000-memory.dmp

Download

memory/3360-15-0x000001C2609F0000-0x000001C260A0C000-memory.dmp

Download

memory/3360-14-0x000001C260990000-0x000001C26099A000-memory.dmp

Download

memory/3360-13-0x000001C2609B0000-0x000001C2609CE000-memory.dmp

Download

memory/3360-12-0x000001C260980000-0x000001C26098A000-memory.dmp

Download

memory/3360-11-0x000001C260C40000-0x000001C260CF2000-memory.dmp

Download

memory/3360-6-0x000001C2608D0000-0x000001C2608F2000-memory.dmp

Download

memory/3360-16-0x000001C2609A0000-0x000001C2609A8000-memory.dmp

Download

memory/3360-17-0x000001C2609D0000-0x000001C2609D6000-memory.dmp

Download

memory/3360-18-0x000001C2609E0000-0x000001C2609EA000-memory.dmp

Download

memory/3360-21-0x000001C261520000-0x000001C2616E2000-memory.dmp

Download

memory/3360-25-0x000001C2609C0000-0x000001C2609D2000-memory.dmp

Download

memory/3360-26-0x000001C2609A0000-0x000001C2609AA000-memory.dmp

Download

memory/3360-65-0x000001C260910000-0x000001C260918000-memory.dmp

Download