xbinder | d171b1a925af513efb2e8386c0ab28267187df27945caa41a9c2721f6f4bbe86

Analysis

user interaction
yes
max time kernel
15s
max time network
32s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
system32.exe
Size 2.1MB
Sample261022-acggdayv9p
SHA256 d171b1a925af513efb2e8386c0ab28267187df27945caa41a9c2721f6f4bbe86
MD5 9db9292669e2b49c81bcd374465542ff
SHA1 7cd929b1cd4be03f54b79468ff58b6bcfc488462
SHA512 51dfbc1ae5109322bae277c34eddadd74ab2a66b8b90de7fd30ccf78e90f97a9786e22f47ca158a6870dcbd7d64008afe0ee675f2d907fbd16777915cbd5015b
SSDEEP 49152:tXcrVmmNccajI+n8hFaAx2nZeY3EZz/Xd:dcrAmNOE5FaAaZe2if
TLSH
T1D2A533F6E7A69156EE7D4A3F407D2168237707EDC523127C1EFAC6952E74E890183B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xbinder loader persistence upx

Malware Config

Extracted

Family

xbinder

Mutex

Bm1TWuyT2goNKuBGv

Attributes

primary_drop_directory
%WinDir%\System32
primary_execute
true
primary_hidden_file
true
primary_resource_name
system.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
true
secondary_resource_name
dControl.exe

Signatures

Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe
4952	powershell.exe
4808	powershell.exe
624	powershell.exe
4436	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
792	system.exe
2280	dControl.exe
5316	dControl.exe
4520	system.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\System32\\system.exe"	system32.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2280-68-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5316-91-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5144-92-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/1656-231-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/3780-233-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5144-248-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe
behavioral2/memory/5144-252-0x0000000000400000-0x00000000004CD000-memory.dmp	autoit_exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\system.exe	system32.exe
File opened for modification	C:\Windows\System32\system.exe	system32.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001b800-47.dat	upx
behavioral2/memory/2280-48-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/2280-68-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5316-91-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5144-92-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/1656-231-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/3780-233-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5144-248-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/memory/5144-252-0x0000000000400000-0x00000000004CD000-memory.dmp	upx
behavioral2/files/0x000500000001b800-842.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dControl.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
716	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3964	schtasks.exe
5140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
624	powershell.exe
624	powershell.exe
2280	dControl.exe
2280	dControl.exe
2280	dControl.exe
2280	dControl.exe
2280	dControl.exe
2280	dControl.exe
4436	powershell.exe
4436	powershell.exe
4436	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	powershell.exe
Token: SeIncreaseQuotaPrivilege	624	powershell.exe
Token: SeSecurityPrivilege	624	powershell.exe
Token: SeTakeOwnershipPrivilege	624	powershell.exe
Token: SeLoadDriverPrivilege	624	powershell.exe
Token: SeSystemProfilePrivilege	624	powershell.exe
Token: SeSystemtimePrivilege	624	powershell.exe
Token: SeProfSingleProcessPrivilege	624	powershell.exe
Token: SeIncBasePriorityPrivilege	624	powershell.exe
Token: SeCreatePagefilePrivilege	624	powershell.exe
Token: SeBackupPrivilege	624	powershell.exe
Token: SeRestorePrivilege	624	powershell.exe
Token: SeShutdownPrivilege	624	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeSystemEnvironmentPrivilege	624	powershell.exe
Token: SeRemoteShutdownPrivilege	624	powershell.exe
Token: SeUndockPrivilege	624	powershell.exe
Token: SeManageVolumePrivilege	624	powershell.exe
Token: 33	624	powershell.exe
Token: 34	624	powershell.exe
Token: 35	624	powershell.exe
Token: 36	624	powershell.exe
Token: SeDebugPrivilege	792	system.exe
Token: SeDebugPrivilege	2280	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	2280	dControl.exe
Token: SeIncreaseQuotaPrivilege	2280	dControl.exe
Token: 0	2280	dControl.exe
Token: SeDebugPrivilege	4520	system.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	5316	dControl.exe
Token: SeAssignPrimaryTokenPrivilege	5316	dControl.exe
Token: SeIncreaseQuotaPrivilege	5316	dControl.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 624	5108	system32.exe	88
PID 5108 wrote to memory of 792	5108	system32.exe	91
PID 5108 wrote to memory of 2280	5108	system32.exe	92
PID 792 wrote to memory of 4436	792	system.exe	97

C:\Users\Admin\AppData\Local\Temp\system32.exe
"C:\Users\Admin\AppData\Local\Temp\system32.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\system.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\System32\system.exe
  "C:\Windows\System32\system.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\system.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4808
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "system" /tr "C:\ProgramData\system.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3964
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "" /tr "C:\Users\Admin\AppData\Roaming"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5140
- C:\Users\Admin\AppData\Local\Temp\dControl.exe
  "C:\Users\Admin\AppData\Local\Temp\dControl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\dControl.exe
    C:\Users\Admin\AppData\Local\Temp\dControl.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
      "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /TI
      4⤵
      PID:5144
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |4308|
        5⤵
        
        PID:1656
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:1632
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:4896
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |4308|1152|
        5⤵
        
        PID:3780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2516
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |4308|
        5⤵
        
        PID:6928
    - - C:\Program Files\Windows Defender\mpcmdrun.exe
        
        "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
        5⤵
        
        PID:6936
    - - C:\Windows\Explorer.exe
        
        "C:\Windows\Explorer.exe" windowsdefender://Threatsettings
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\dControl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\dControl.exe" /EXP |4308|6920|
        5⤵
        
        PID:7080

C:\Windows\System32\system.exe
C:\Windows\System32\system.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2040
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:1532
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:1440
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:1804
- C:\Windows\system32\gpscript.exe
  gpscript.exe /RefreshSystemParam
  2⤵
  PID:1020

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:3960
- C:\Windows\system32\wbem\mofcomp.exe
  C:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"
  2⤵
  PID:2260
- C:\Windows\system32\taskkill.exe
  C:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe
  2⤵
  - Kills process with taskkill
  PID:716
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\969D63F4-8A4D-B6DF-1804-0E37CA411942.man
  2⤵
  PID:4144
- C:\Windows\system32\wevtutil.exe
  C:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\969D63F4-8A4D-B6DF-1804-0E37CA411942.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"
  2⤵
  PID:3780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4208
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:4520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1548

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3392

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1420

C:\Program Files\Windows Defender\MsMpEng.exe
"C:\Program Files\Windows Defender\MsMpEng.exe"
1⤵
PID:6948

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ntuser.pol

Path C:\ProgramData\Microsoft\GroupPolicy\Users\S-1-5-21-1404337215-1550464601-2805570857-1000\ntuser.pol
Size 258B
SHA256 26332af7f0dcf06a13abb741e5eaa39f0ff9e7e823512701500b4e52340357ab
MD5 075b0da82e23780fa2dd7f2ea0464fd4
SHA1 aa551b180671ab7c1fb9646e3c4a534f3ab6e758
SHA512 86c60e474fd6a8b4f9059e96a7658a5b2cd30bbc77d53d2c647c178c72e3d3cb88864317f6d88e8cca4d576771b02ae7fcb188d6499f849af6d47aee6f6b838e
TLSH
T101D0C70156F92A54E7FE1E31282399945E777A262B34C88C3154524F0C35E14CF51327
MD5 SHA1 SHA512 TLSH

Submit Download

MPDetection-20261022-010414.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20261022-010414.log
Size 344B
SHA256 b057c606b35c3a6babde333915f8bf55cf783f78cd268b0e30b2a81106f2bd60
MD5 d317debbfcbdb9a50fbef22eade820f9
SHA1 64bd743690aeb8d3b2f26e3cd517b10899f7058a
SHA512 46b59c1964bce0ebfba0cded18f7a2548bf11bfa63587f4472419e8f075f41910c95646dc156327b92b94dd15ac8d3cbba5d6f5563f69dd63bc30b7af8559fa6
TLSH
T1D2E08C2D0AF80667B0B0FA8B8AF101536A71B8855438AD1C02E05F4A1A23D52F8A0F5B
MD5 SHA1 SHA512 TLSH

Submit Download

MPDeviceControl-20261022-010414.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20261022-010414.log
Size 3KB
SHA256 c67ba4c6d32100a2eb44f3f735628d63c291b2f1a7431c40d3cf00b374dd0885
MD5 ae85b2992eba0831b5cdf50f07786b96
SHA1 0671bd5410a1a2f8df2fc626fdffca164be07e53
SHA512 98e8897dfefe89c0edad0c1984f23c38c16fc937dec2643b967e1e307058aa937cac08ee1b7bd7ec36f81ce433094c958ffaaae07d02707d1e1774a6ab7e1b71
TLSH
T10461630D23F82A0EF8E59B92FEFB88136932FDA05978D61C21B5574D0271C54E9A0B37
MD5 SHA1 SHA512 TLSH

Submit Download

MPLog-20261022-010414.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20261022-010414.log
Size 39KB
SHA256 ee0d0d8897fc7d6f8b3232e7f287ca3dae7e6c0624907be92542c35ba4ea9e86
MD5 da40c86f9dc9f352677159fcc9317eca
SHA1 435c0585501054fff078593fdb22b1a9319e4f6f
SHA512 49bb9ecc1ccaf093e1e69745401af3fde6b89acb9bc0fbd00ea8867cbf23bb5c8e8f61f4986d139e04d8ca8e60e4c053c8eed8a9f7bc656c098571d1175896ac
SSDEEP 384:2P+p7P6q0j/7DR/4N29O6YOHFOBLO5pnrk2RfQ46LIHoxmD6pqLDM2GGyDy/:/7P6q0i29O6YOHFOBLO5pnr+46LKzN
TLSH
T10903C50A57F84649F1B3EF1AADF784235A72BC956938DA1D02D0474E09BAE10F870B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MPScanSkip-20261022-010414.log

Path C:\ProgramData\Microsoft\Windows Defender\Support\MPScanSkip-20261022-010414.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ntuser.pol

Path C:\ProgramData\ntuser.pol
Size 410B
SHA256 e05e235a453c0588da42521bab312e8546461c1f46e91afc7e20961a36c7529f
MD5 439cd289be531c36fafd88dbbeb1bdc5
SHA1 3caa06c8646a67ef41015cdd777c4647d44fa880
SHA512 020a346aad24c1f804fd80cdb7ff3ebe249dfed27e0379c62b76b930e6be4512008467990d3b44858e3b93c293b54ba86f4cea8610d4f896b31d37129823fa4f
TLSH
T139E01A0156F82A14FBFF0E312833A9985E7B79262B24C88C2158424E4835E24CF2232B
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aea3d97d05063195fbb06e1f2ab076de8e2cccc5979fda502c78e39b5b7e871b
MD5 863dd991c56c4b2ff2a690b21ee76f07
SHA1 cce6fd59eb290f841d0d008b3820340599be6c66
SHA512 a73378a797afe20630d0c2fc30a44b2cd13d16589ce7f2805f63d6c427e75b19a2a7c14dab6594a351f19c7794838b5c13b993c68a8dd15e5e31cd3ebbc2fc22
TLSH
T1CA216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2307028c768767d7f131a8c5b416037f6bc975943dec7491be7a5738777dbd1c
MD5 062e05f435c032fb0b6df70feb495c1f
SHA1 55cdc13d4ec5e1f2db15cfbf957101629d4a1107
SHA512 6cb19e340bcc83e014b72c8a58eb1bdbc85610328aedb6f0ce716616b13072f8182741d708911c832715c50746acf2eeb94d4b6e829c7474e54fa19c6e4341c5
TLSH
T1A3216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

2h2y8a0m.tmp

Path C:\Users\Admin\AppData\Local\Temp\2h2y8a0m.tmp
Size 37KB
SHA256 a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79
MD5 3bc9acd9c4b8384fb7ce6c08db87df6d
SHA1 936c93e3a01d5ae30d05711a97bbf3dfa5e0921f
SHA512 f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

MasonKit.exe

Path C:\Users\Admin\AppData\Local\Temp\MasonKit.exe
Size 595KB
SHA256 7596f8d9c6fca490a5d657b994c0399ce5197e41102c66fe296408f5b37bf3f1
MD5 75c6f68abba95ddfd287f61b827e2711
SHA1 5dbd72d6e361b6af2e89b2aa49d3b64bd81d71a1
SHA512 103c3d754f26c059876a7c835b7bb69401d38a7b42cde7878a25cf5f127a77657b00d9d03d3eecbc08237c79d497785b69fd31560127dd37758dbe32d77b2e11
SSDEEP 12288:fWVkPQzRl9YrTK0zqIDlEUHlJd8+zvw5pMN7H1xpxnlRGakrE9d0D:eVOQj+dWID+yG+zIzy7VxflRGa+Ci
TLSH
T1E7D423BC22F8F19DD54DC9393BF7025A4221F52F5810A36227A459CD2EF382D8D8DE65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ym0efqbu.fgj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ym0efqbu.fgj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dControl.exe

Path C:\Users\Admin\AppData\Local\Temp\dControl.exe
Size 447KB
SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
MD5 58008524a6473bdf86c1040a9a9e39c3
SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
TLSH
T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dControl.exe

Path C:\Users\Admin\AppData\Local\Temp\dControl.exe
Size 384KB
SHA256 9fe7d46574e1a9df6ab6212a4ecb0823480ae3bce2bcad6417b57bc6bd9271d2
MD5 b8cd0d5cfd9cd4caebde4915e44f5879
SHA1 0594f79b6f8447b42b475e2ac151489f41d4eee3
SHA512 21f90bf561fa905eb8c032acebd2ff9095380a14b205ae6e965e1c3611d000db02dab9495e0f4ee31c19ca40b30696dab0bdfedf6d35c90d644a650c231ae5da
SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYx:Vzcn7EanlQiWtYhmJFSwUBLc7
TLSH
T1FF841292D1045CD6D4270339CF37BFF38EB1AEFE565A078244B4787B387A9922198A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dControl.ini

Path C:\Users\Admin\AppData\Local\Temp\dControl.ini
Size 2KB
SHA256 4198b363374f055dc4d95ce28180599ac210c4ff7baa1ea64678c6e127211cbe
MD5 aec76adbb6a3da24a11c23e0bb1d308e
SHA1 66a679e90ca6907b8609eb313db59b7a62d08dfc
SHA512 97fb4ae29a9734d5b1cdc134d68d8061abd9ff10407294fb8f5eff06fa1690cc69af0beed5b64e5c5018b2cd509e0447b09903d45ebb1479c2ba116f145904bc
TLSH
T120417C1653F96209F2F26B64E6B40A324B327C99A83CD58C0AD44D8D0DF4F108822BFB
MD5 SHA1 SHA512 TLSH

Submit Download

registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\registry.pol
Size 160B
SHA256 6509c7fc4fa70391399831bbc3d66206d3f6f8f2bb20ffcac4e04844861d733a
MD5 58f8eb09a822c09fc11f5a42baae36f1
SHA1 9e7063eeee62c8588e0020bef3a116e9379966aa
SHA512 53806780934bd86bb032ee4a515dfc0e8464a5ecc5f4c8c593304fcd969c1058d443bdec54e7ae21469adb942b16693cc9eaf997217adc69d3618ab0ec99dc1e
TLSH
T1F0C0480007F82714FAFF4E351A732948683A782AAA00D88C0168494D8876E34CB2332B
MD5 SHA1 SHA512 TLSH

Submit Download

registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\registry.pol
Size 8B
SHA256 5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89
MD5 8e1b08222f20e45a3e8db04c569f9cb7
SHA1 a6ac68fbadf96faba3af7000a7514790157f930f
SHA512 414d30dec0fce6b4e3ab52c50f064262e0df00cf9dbbeacca271a0991555371a37cfffdd0486c07a9096838942a69cdbefea4a4399ef2848139678daff589c31
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 233B
SHA256 1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
MD5 cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1 a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA512 29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
TLSH
T1F4D0955244C01530C01D9103C0FD113C865D1908D1E048FFC2B7D15E11A3526FC3DF11
MD5 SHA1 SHA512 TLSH

Submit Download

system.exe

Path C:\Windows\System32\system.exe
Size 1.6MB
SHA256 83e93cef77236c547ea74dd6f20462463c82d6ec67996a6d3270b47df09fca4e
MD5 de0915853cb494784d43f28eed47e76e
SHA1 a27e21d9aa8518d4ee1f8073c331b0beae17fcb3
SHA512 691758da4aa9c2f3cb597e8a1ee381fb1b8cb7e91e1e49b2e4ee17a413045006c732a187a15c861eb5fcd9e65a5efa36bcd953d2154ed67f9a1b78788099980e
SSDEEP 24576:snFlOCgJFLR57MhUjwmd8iXeBR3Lhwk8nqFJCF92Tuo7wPEcEn5fWuBXzvxzxR:snSC4MCjwmd8V3ik5KF9QQPENLlF
TLSH
T1DF8533E79AE1D16DEEBD4F3B017E1028237A0BACC863DA3C5AE6D1560F6498C41C7749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

969D63F4-8A4D-B6DF-1804-0E37CA411942.man

Path C:\Windows\SystemTemp\969D63F4-8A4D-B6DF-1804-0E37CA411942.man
Size 74KB
SHA256 1114198d6d76348ef6a7b6ae528c77e06f51369802af24ba9ad5f56fc73cb63d
MD5 f2cc8125493496245b6ec1297ac2a502
SHA1 0424a8430eda346ad6e627e7fd41710e28b541da
SHA512 77aadcada3ca13f4a420565e0c41695cbebc8b0132f4f1ff33b3c090c5234ae143ef7f56cba8be8b946ccad88407a2fc3dc84df8493066346c83adfa622daa98
SSDEEP 384:gdejk8/WmmU3LHzdphANk2s5p5BIyJDHEhJjNQrAUOmpd5+ofhyIyG42VtclEltK:g8kXmmMu6S3KNi
TLSH
T1A473E390F458ACE14D08376B59FC9904153EFEBA47E820AB7CE4A977A75B70437B0B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autE16D.tmp

Path C:\Windows\Temp\autE16D.tmp
Size 14KB
SHA256 8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3
MD5 9d5a0ef18cc4bb492930582064c5330f
SHA1 2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8
SHA512 1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4
SSDEEP 384:Lc+oi65hxQuuaeawNT9vyk+8fYkjeXGsuojMExHixvLiH:Lvqxpkaw9oD0Jje2sZPxCxvGH
TLSH
T1A162BE8D3D193109F2A2A4D14B7197A06E1FCBD0794C67285F90C9366E72FB1B2E3227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autE16E.tmp

Path C:\Windows\Temp\autE16E.tmp
Size 12KB
SHA256 5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366
MD5 efe44d9f6e4426a05e39f99ad407d3e7
SHA1 637c531222ee6a56780a7fdcd2b5078467b6e036
SHA512 8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63
SSDEEP 384:cIbUPrMe4JQrf/GvefQ9Ruiwwyeq62BYZ:l+getDi9Cq2yZ
TLSH
T1EC42D1506C29AD2E63768D9D93A9E701ADB107D11140CD52B24337FA9E4A8CAF349C3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autE16F.tmp

Path C:\Windows\Temp\autE16F.tmp
Size 7KB
SHA256 9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5
MD5 ecffd3e81c5f2e3c62bcdc122442b5f2
SHA1 d41567acbbb0107361c6ee1715fe41b416663f40
SHA512 7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76
SSDEEP 192:IsyIiAhPheSUbYWJ/sktA3qM9snQWjljZ1hkDjuQ0C1yW:IBXAhPheSaYCEGAHaQWdmxrkW
TLSH
T1FDF1AE1C4A7099792F10A6273A9BD71921FF8EE74397E0A39450A79AF0E2389C648F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-14-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-21-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-29-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-26-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-4-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-18-0x0000019EF5BC0000-0x0000019EF5BDE000-memory.dmp

Download

memory/624-7-0x0000019EF5AA0000-0x0000019EF5AC2000-memory.dmp

Download

memory/624-25-0x0000019EF5BB0000-0x0000019EF5BBA000-memory.dmp

Download

memory/624-24-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-23-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-8-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-19-0x0000019EF5E00000-0x0000019EF5EB2000-memory.dmp

Download

memory/624-20-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-27-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-22-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-9-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-15-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-10-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-13-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-12-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/624-11-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/792-237-0x000000001BCC0000-0x000000001BE64000-memory.dmp

Download

memory/792-45-0x0000000000390000-0x000000000053A000-memory.dmp

Download

memory/1656-231-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2280-68-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2280-48-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/2516-251-0x00000207B3E70000-0x00000207B3F22000-memory.dmp

Download

memory/3780-233-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/3960-342-0x0000020994B00000-0x0000020994B01000-memory.dmp

Download

memory/3960-347-0x0000020994ED0000-0x0000020994ED1000-memory.dmp

Download

memory/3960-313-0x00000209949A0000-0x00000209949A4000-memory.dmp

Download

memory/3960-314-0x00000209A6FF0000-0x00000209A6FF4000-memory.dmp

Download

memory/3960-315-0x00000209B4FF0000-0x00000209B4FF4000-memory.dmp

Download

memory/3960-316-0x00000209BA820000-0x00000209BA824000-memory.dmp

Download

memory/3960-317-0x00000209BA830000-0x00000209BA834000-memory.dmp

Download

memory/3960-310-0x00000209A5950000-0x00000209A5E97000-memory.dmp

Download

memory/3960-311-0x00000209A5F80000-0x00000209A6650000-memory.dmp

Download

memory/3960-312-0x00000209A66C0000-0x00000209A66C1000-memory.dmp

Download

memory/3960-332-0x00000209A6760000-0x00000209A6764000-memory.dmp

Download

memory/3960-337-0x00000209A67B0000-0x00000209A6820000-memory.dmp

Download

memory/3960-336-0x00000209A67A0000-0x00000209A67A4000-memory.dmp

Download

memory/3960-371-0x00000209BAA80000-0x00000209BAA81000-memory.dmp

Download

memory/3960-370-0x00000209BAA70000-0x00000209BAA71000-memory.dmp

Download

memory/3960-369-0x00000209BAA60000-0x00000209BAA61000-memory.dmp

Download

memory/3960-368-0x00000209BAA50000-0x00000209BAA51000-memory.dmp

Download

memory/3960-367-0x00000209BAA40000-0x00000209BAA41000-memory.dmp

Download

memory/3960-366-0x00000209BAA30000-0x00000209BAA31000-memory.dmp

Download

memory/3960-365-0x00000209BAA20000-0x00000209BAA21000-memory.dmp

Download

memory/3960-364-0x00000209BAA10000-0x00000209BAA11000-memory.dmp

Download

memory/3960-363-0x00000209BAA00000-0x00000209BAA01000-memory.dmp

Download

memory/3960-362-0x00000209BA9F0000-0x00000209BA9F1000-memory.dmp

Download

memory/3960-361-0x00000209BA9E0000-0x00000209BA9E1000-memory.dmp

Download

memory/3960-360-0x00000209BA9D0000-0x00000209BA9D1000-memory.dmp

Download

memory/3960-359-0x00000209BA9C0000-0x00000209BA9C1000-memory.dmp

Download

memory/3960-358-0x00000209BA9B0000-0x00000209BA9B1000-memory.dmp

Download

memory/3960-357-0x00000209BA9A0000-0x00000209BA9A1000-memory.dmp

Download

memory/3960-356-0x00000209BA990000-0x00000209BA991000-memory.dmp

Download

memory/3960-355-0x00000209BA980000-0x00000209BA981000-memory.dmp

Download

memory/3960-354-0x00000209BA970000-0x00000209BA971000-memory.dmp

Download

memory/3960-353-0x00000209BA960000-0x00000209BA961000-memory.dmp

Download

memory/3960-352-0x00000209A6AE0000-0x00000209A6AE1000-memory.dmp

Download

memory/3960-351-0x00000209A69D0000-0x00000209A69D1000-memory.dmp

Download

memory/3960-350-0x00000209A6900000-0x00000209A6901000-memory.dmp

Download

memory/3960-349-0x0000020994FF0000-0x0000020994FF1000-memory.dmp

Download

memory/3960-348-0x0000020994F20000-0x0000020994F21000-memory.dmp

Download

memory/3960-318-0x00000209BA880000-0x00000209BA884000-memory.dmp

Download

memory/3960-346-0x0000020994D80000-0x0000020994D81000-memory.dmp

Download

memory/3960-345-0x0000020994CF0000-0x0000020994CF1000-memory.dmp

Download

memory/3960-344-0x0000020994BE0000-0x0000020994BE1000-memory.dmp

Download

memory/3960-343-0x0000020994B50000-0x0000020994B51000-memory.dmp

Download

memory/3960-319-0x00000209BA890000-0x00000209BA894000-memory.dmp

Download

memory/3960-341-0x00000209949F0000-0x00000209949F1000-memory.dmp

Download

memory/3960-340-0x00000209BB4E0000-0x00000209BB5A6000-memory.dmp

Download

memory/3960-339-0x00000209A6890000-0x00000209A6891000-memory.dmp

Download

memory/3960-338-0x00000209A6820000-0x00000209A6888000-memory.dmp

Download

memory/3960-335-0x00000209A6790000-0x00000209A6794000-memory.dmp

Download

memory/3960-334-0x00000209A6780000-0x00000209A6784000-memory.dmp

Download

memory/3960-333-0x00000209A6770000-0x00000209A6774000-memory.dmp

Download

memory/3960-331-0x00000209A6750000-0x00000209A6754000-memory.dmp

Download

memory/3960-330-0x00000209A6740000-0x00000209A6744000-memory.dmp

Download

memory/3960-329-0x00000209A6730000-0x00000209A6734000-memory.dmp

Download

memory/3960-328-0x00000209A6720000-0x00000209A6724000-memory.dmp

Download

memory/3960-327-0x00000209A6710000-0x00000209A6714000-memory.dmp

Download

memory/3960-326-0x00000209A6700000-0x00000209A6704000-memory.dmp

Download

memory/3960-325-0x00000209A66F0000-0x00000209A66F4000-memory.dmp

Download

memory/3960-324-0x00000209A66E0000-0x00000209A66E4000-memory.dmp

Download

memory/3960-323-0x00000209A66D0000-0x00000209A66D4000-memory.dmp

Download

memory/3960-322-0x00000209A66B0000-0x00000209A66B4000-memory.dmp

Download

memory/3960-321-0x00000209A66A0000-0x00000209A66A4000-memory.dmp

Download

memory/3960-320-0x00000209A6690000-0x00000209A6694000-memory.dmp

Download

memory/4436-111-0x00000245C71B0000-0x00000245C7262000-memory.dmp

Download

memory/4808-171-0x0000027731E20000-0x0000027731ED2000-memory.dmp

Download

memory/5108-0-0x00007FFFF3D4F000-0x00007FFFF3D50000-memory.dmp

Download

memory/5108-30-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/5108-50-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/5108-3-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/5108-2-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp

Download

memory/5108-1-0x0000000000390000-0x00000000005A4000-memory.dmp

Download

memory/5144-252-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5144-248-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5144-92-0x0000000000400000-0x00000000004CD000-memory.dmp

Download

memory/5316-91-0x0000000000400000-0x00000000004CD000-memory.dmp

Download