sheetrat | 0db4cda2c691f22a9924aa46cebd1b0f7ce9e4721504deb347243f2340bf5796

Analysis

user interaction
yes
max time kernel
299s
max time network
274s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/06/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vzpv0yj4nm6z6ye4.exe
Size 198KB
Sample260619-3qe5padt21
SHA256 0db4cda2c691f22a9924aa46cebd1b0f7ce9e4721504deb347243f2340bf5796
MD5 af78d5c56d8131f7924c108bccd009c0
SHA1 60bfb30f262144f0b53ba436101797e8c77741b3
SHA512 cc58fda40f2a0cb809b7e1c7d1d723b7a3b0e8ecf7c27f4e8dc80ab2047ebee497c5d89f9e25bd0160139f509efcdc43aaa5e3b80e89757576bfb216de8a4fe7
SSDEEP 3072:mmqA30Tl5sJtbsSARusP2b6hLfzk4W6LT6lPJAg+cG+R9DBkMYdTCz1YSObnNenj:nCl6JkusuKi0OlPfh/BOPxbGh
TLSH
T11C14F1C077C09A12EC7E16B993A333905334E1536E42D75F2EDA80D2AF6A3D5991ECE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura defense_evasion execution sheetrat packer persistence trojan

Malware Config

Extracted

Family

sheetrat

Attributes

anti_virtual
false
certificate
tg32pbx36hrwx
exclusion_wd
p4j)l+7lp9h#
hidden_file
z1c067z@j#aws*pgvazf#14
key
0edky705o05i3ejgf34dl4p5uzzn
path_client
@2gg+y22^kcbg&
path_watch_dog
ydjc@4u*0yj7j*
pump
6r637x20olf_jpbknre6h1k%
rootkit
;<WWgvBg;
task_client
g$71^9!$)fms$
task_watch_dog
4it**_3@gzp47
use_install_admin
^$y*y*3i5hj*@
user_init
kes6@w@yr

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat Payload 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/2844-0-0x0000027CE2B60000-0x0000027CE2B96000-memory.dmp	family_sheetrat_v1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\Control Panel\International\Geo\Nation	vzpv0yj4nm6z6ye4.exe

Executes dropped EXE 3 IoCs

pid	Process
500	tmpEF86.tmp.exe
1176	tmpEF86.tmp.exe
2320	tmpEF86.tmp.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpEF86.tmp.exe\""	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpEF86.tmp.exe\" -startup"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	tmpEF86.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131776342-1023621610-2767477260-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	tmpEF86.tmp.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
11	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2516	powershell.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4464	cmd.exe
1832	cmd.exe
3240	cmd.exe
1364	cmd.exe
5896	cmd.exe
5928	cmd.exe

Costura .NET executable packer 2 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/2844-5-0x0000027C80110000-0x0000027C80188000-memory.dmp	costura
behavioral1/memory/2844-64-0x0000027C80560000-0x0000027C8057C000-memory.dmp	costura

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5220	taskkill.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2516	powershell.exe
2516	powershell.exe
500	tmpEF86.tmp.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2844	vzpv0yj4nm6z6ye4.exe
Token: SeIncBasePriorityPrivilege	2844	vzpv0yj4nm6z6ye4.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	500	tmpEF86.tmp.exe
Token: SeDebugPrivilege	5220	taskkill.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 224	2844	vzpv0yj4nm6z6ye4.exe	102
PID 224 wrote to memory of 2516	224	cmd.exe	104
PID 2516 wrote to memory of 500	2516	powershell.exe	105
PID 500 wrote to memory of 5928	500	tmpEF86.tmp.exe	107
PID 500 wrote to memory of 5896	500	tmpEF86.tmp.exe	108
PID 500 wrote to memory of 1364	500	tmpEF86.tmp.exe	109
PID 500 wrote to memory of 3240	500	tmpEF86.tmp.exe	110
PID 500 wrote to memory of 1832	500	tmpEF86.tmp.exe	111
PID 500 wrote to memory of 4464	500	tmpEF86.tmp.exe	112
PID 500 wrote to memory of 5220	500	tmpEF86.tmp.exe	113
PID 1364 wrote to memory of 5428	1364	cmd.exe	131
PID 4464 wrote to memory of 3756	4464	cmd.exe	132
PID 5928 wrote to memory of 5764	5928	cmd.exe	133
PID 1832 wrote to memory of 4056	1832	cmd.exe	134
PID 5896 wrote to memory of 5768	5896	cmd.exe	135
PID 3240 wrote to memory of 5908	3240	cmd.exe	136
PID 1364 wrote to memory of 3744	1364	cmd.exe	139
PID 5896 wrote to memory of 5952	5896	cmd.exe	140
PID 3240 wrote to memory of 392	3240	cmd.exe	141
PID 1832 wrote to memory of 3668	1832	cmd.exe	142
PID 4464 wrote to memory of 2808	4464	cmd.exe	143
PID 5928 wrote to memory of 3360	5928	cmd.exe	144

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5908	attrib.exe
5952	attrib.exe
3360	attrib.exe
3756	attrib.exe
3744	attrib.exe
392	attrib.exe
3668	attrib.exe
2808	attrib.exe
5428	attrib.exe
5764	attrib.exe
5768	attrib.exe
4056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\vzpv0yj4nm6z6ye4.exe
"C:\Users\Admin\AppData\Local\Temp\vzpv0yj4nm6z6ye4.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:500
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5928
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:5764
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3360
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:5896
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:5768
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:5952
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:5428
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3744
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3240
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:5908
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:392
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:1832
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Drops desktop.ini file(s)
        Views/modifies file attributes
        
        PID:4056
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:3668
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @123123 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
        5⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s +r +i /D
        6⤵
        Views/modifies file attributes
        
        PID:3756
      - C:\Windows\system32\attrib.exe
        
        attrib -h +s +r info-Locker.txt
        6⤵
        Views/modifies file attributes
        
        PID:2808
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill.exe /im Explorer.exe /f
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5220

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3364" "2328" "2248" "2332" "0" "0" "0" "0" "0" "0" "0" "0"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3532

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x394 0x380
1⤵
PID:5680

C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe" -startup
1⤵
- Executes dropped EXE
PID:1176

C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe"
1⤵
- Executes dropped EXE
PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpEF86.tmp.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\tmpEF86.tmp.exe.log
Size 1KB
SHA256 77071d2e1fdfc305512f111f44cebf7231f696c3bed3cdf5fd369b4485330d9c
MD5 b2385a5c9864a22996a735d92ea0bbea
SHA1 6102095de817c5118b2daff432176cb1a6c31e70
SHA512 9e4b1da35348bc9e047334082a56a765d8dbcbd86594818f1dddbc46fbb6279f4389333d6fd2567466f948d1f62f0af343e48474c98c0d148f4e27ae8a2a2816
TLSH
T1D531DC7022B6B1D889023F470C6D29C417BF4329B560AE0CBAA8525EDD2B0175F323F3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fl0kpce0.b2e.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fl0kpce0.b2e.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpEF86.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpEF86.tmp.exe
Size 212KB
SHA256 20414941c886b8bfbc4cff8864351f877a6b4835b632f5636788adda59a618a2
MD5 dcb5e1789ddb4d9da246c449a4abaf94
SHA1 84d67878827bf216b5003706e402843109416f13
SHA512 71bff2bc5947b4c7864a4b13564e221a74f473eb71f61a8f41173b6b904d743cab06c291cf3ec3b7bb794da76741fbbba4c089d1a588685819088d71ace6b1c9
SSDEEP 3072:Qarwffnsk6OZdwrAH3q2nQEtQ0UHNoW/4pwQSCpMW90KImQiO7be6snKGqtX:effZPnRtQ0UOWA7SCpMW90KImQiO7bR
TLSH
T1A7244B88136F8D3ED2AF4B79E0B1630643F8A3279653F74E6CE5D8995E673418A00B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locker_debug.txt

Path C:\Users\Admin\Desktop\locker_debug.txt
Size 765B
SHA256 d65df02a302881490808ef9dc36bc5f88ba188f2a1feaadb08897bb0d94e11d3
MD5 a61a7d781dd981b09f25568e748aa7b6
SHA1 6ea1c5719775a79367573ff3b0f7bdf9572a6be0
SHA512 13d4bb91237eef29be6494a46c25d6c693a33aa720f233c6b0f2e2dd76ddd9d7542892d58794d0e68c14e91bd6b5b59213e2d35872c6f8618291517935b09177
TLSH
T1FB015E47C1D98EED029B626F68CD0A04AE8526390102C55FFA09C85C7F6C59A096EF71
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 73B
SHA256 9ab23a296ed143466baae10d307e4c769b9dd83f5ba9acf3eb080f8a1c401c1a
MD5 af5394e984347b02fa22016afa6fca1d
SHA1 941f9d5fa6260244b70fbe3d49a2e2a08b1d9d74
SHA512 d5cd5bdfab1ad2db0463f8a350f7cfe161b01e0553d093b85d1262161dc323f86b71bf8268de6ec0e176561d8f05a17d0f5486246b4160e756423e03d86f619d
TLSH
T152A022C03CAC3AC8200020F33832B220A8BEECCE30032CC2030020A300A08C82AEFC20
MD5 SHA1 SHA512 TLSH

Submit Download

memory/500-28-0x0000000000C30000-0x0000000000C6C000-memory.dmp

Download

memory/2516-23-0x00000263D01C0000-0x00000263D01E2000-memory.dmp

Download

memory/2844-5-0x0000027C80110000-0x0000027C80188000-memory.dmp

Download

memory/2844-14-0x0000027C807E0000-0x0000027C807EC000-memory.dmp

Download

memory/2844-8-0x0000027C802A0000-0x0000027C802EA000-memory.dmp

Download

memory/2844-0-0x0000027CE2B60000-0x0000027CE2B96000-memory.dmp

Download

memory/2844-7-0x0000027C80270000-0x0000027C8029A000-memory.dmp

Download

memory/2844-6-0x0000027C80220000-0x0000027C8026C000-memory.dmp

Download

memory/2844-13-0x0000027C808F0000-0x0000027C80E2E000-memory.dmp

Download

memory/2844-4-0x0000027CFDCC0000-0x0000027CFDCD0000-memory.dmp

Download

memory/2844-1-0x0000027CFDCC0000-0x0000027CFDCD0000-memory.dmp

Download

memory/2844-63-0x0000027C804C0000-0x0000027C804D0000-memory.dmp

Download

memory/2844-64-0x0000027C80560000-0x0000027C8057C000-memory.dmp

Download

memory/2844-65-0x0000027C80580000-0x0000027C80596000-memory.dmp

Download

memory/2844-66-0x0000027C80510000-0x0000027C8051C000-memory.dmp

Download