sheetrat | f85dfb628ab7fce068d68744a68d058b33f41908a8c6caf5bb6e3382f1dbf210

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 423KB
Sample260628-v63a6aav4y
SHA256 f85dfb628ab7fce068d68744a68d058b33f41908a8c6caf5bb6e3382f1dbf210
MD5 304c79cbb802d8581220aa0fb6097392
SHA1 ce486b370076930605e7c58c26591061e2f51070
SHA512 8202d6a47ccdfc76e4c5aa059952269142c156862373649361296f5c2e4ab97a575352fc5b86ea48590de004e1904972e91c69c7cdd06d12a62657afd3f874cb
SSDEEP 6144:gp5pLJ+GG6raJq9K8hDe6VlWT8b9WpDTrOEb+ml3EogqyTHu:kLJDG6r+aDPVle8y9E15TH
TLSH
T14094C30CBE80E801CD293973CBE5D030DB7139C12E15929E765A6EEB4B673F658A617C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_lchunwmieu execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

v1.2

Campaign

Sheet_lchunwmieu

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/3844-0-0x0000000000AA0000-0x0000000000B10000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdGIMP Upgrade.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
3824	xdwdMicrosoft Edge DevTools.exe
4916	xdwdGIMP Upgrade.exe

Loads dropped DLL 50 IoCs

pid	Process
5660	Process not Found
2040	Process not Found
2460	Process not Found
3652	Process not Found
6452	Process not Found
5020	Process not Found
3824	xdwdMicrosoft Edge DevTools.exe
3268	Process not Found
3756	Process not Found
4404	Process not Found
4960	Process not Found
244	Process not Found
5568	Process not Found
6744	Process not Found
1248	Process not Found
3060	Process not Found
3696	Process not Found
4916	xdwdGIMP Upgrade.exe
1952	Process not Found
1828	Process not Found
2940	Process not Found
3768	Process not Found
5924	Process not Found
748	Process not Found
1920	Process not Found
6236	Process not Found
6808	Process not Found
6260	Process not Found
2696	Process not Found
1788	Process not Found
6264	Process not Found
4396	Process not Found
1748	Process not Found
3676	Process not Found
5660	Process not Found
3024	Process not Found
6356	Process not Found
4360	Process not Found
1824	Process not Found
5232	Process not Found
4432	Process not Found
5692	Process not Found
1772	Process not Found
2200	Process not Found
4156	Process not Found
6824	Process not Found
1876	Process not Found
6468	Process not Found
896	Process not Found
6488	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4274393721-1801116158-3678143273-1000\Software\Microsoft\Windows\CurrentVersion\Run\poshelnaxyu = "C:\\Windows\\xdwdMicrosoft Edge DevTools.exe"	Client.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\xdwdMicrosoft Edge DevTools.exe	Client.exe
File opened for modification	C:\Windows\xdwdMicrosoft Edge DevTools.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe
File opened for modification	C:\Windows\xdwdMicrosoft Edge DevTools.exe	xdwdMicrosoft Edge DevTools.exe
File opened for modification	C:\Windows\xdwdMicrosoft Edge DevTools.exe	xdwdGIMP Upgrade.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5588	schtasks.exe
5240	schtasks.exe
2168	schtasks.exe
1452	schtasks.exe
4300	schtasks.exe
5616	schtasks.exe
5364	schtasks.exe
3416	schtasks.exe
892	schtasks.exe
3660	schtasks.exe
6920	schtasks.exe
6452	schtasks.exe
4700	schtasks.exe
6868	schtasks.exe
4740	schtasks.exe
3540	schtasks.exe
4272	schtasks.exe
4532	schtasks.exe
6348	schtasks.exe
5440	schtasks.exe
1512	schtasks.exe
4440	schtasks.exe
6712	schtasks.exe
3468	schtasks.exe
6396	schtasks.exe
4224	schtasks.exe
4584	schtasks.exe
2760	schtasks.exe
6068	schtasks.exe
1648	schtasks.exe
6692	schtasks.exe
4820	schtasks.exe
5472	schtasks.exe
6940	schtasks.exe
2312	schtasks.exe
1696	schtasks.exe
6544	schtasks.exe
2536	schtasks.exe
2636	schtasks.exe
2476	schtasks.exe
2168	schtasks.exe
6584	schtasks.exe
6692	schtasks.exe
244	schtasks.exe
5964	schtasks.exe
5108	schtasks.exe
3048	schtasks.exe
6228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe
3844	Client.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	Client.exe
Token: SeDebugPrivilege	3824	xdwdMicrosoft Edge DevTools.exe
Token: SeDebugPrivilege	4916	xdwdGIMP Upgrade.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 5276	3844	Client.exe	91
PID 5276 wrote to memory of 4440	5276	CMD.exe	93
PID 3844 wrote to memory of 5968	3844	Client.exe	94
PID 5968 wrote to memory of 4272	5968	CMD.exe	96
PID 3844 wrote to memory of 6288	3844	Client.exe	97
PID 6288 wrote to memory of 5588	6288	CMD.exe	99
PID 3844 wrote to memory of 2524	3844	Client.exe	102
PID 2524 wrote to memory of 5964	2524	CMD.exe	104
PID 3844 wrote to memory of 6820	3844	Client.exe	105
PID 6820 wrote to memory of 5240	6820	CMD.exe	107
PID 3844 wrote to memory of 4540	3844	Client.exe	108
PID 4540 wrote to memory of 2168	4540	CMD.exe	110
PID 3844 wrote to memory of 6896	3844	Client.exe	112
PID 6896 wrote to memory of 4532	6896	CMD.exe	114
PID 3844 wrote to memory of 1792	3844	Client.exe	115
PID 1792 wrote to memory of 5108	1792	CMD.exe	117
PID 3844 wrote to memory of 3820	3844	Client.exe	118
PID 3820 wrote to memory of 6712	3820	CMD.exe	120
PID 3844 wrote to memory of 1116	3844	Client.exe	121
PID 1116 wrote to memory of 6692	1116	CMD.exe	123
PID 3844 wrote to memory of 2732	3844	Client.exe	124
PID 2732 wrote to memory of 6348	2732	CMD.exe	126
PID 3824 wrote to memory of 6056	3824	xdwdMicrosoft Edge DevTools.exe	127
PID 6056 wrote to memory of 4820	6056	CMD.exe	129
PID 3844 wrote to memory of 1192	3844	Client.exe	130
PID 1192 wrote to memory of 3048	1192	CMD.exe	132
PID 3844 wrote to memory of 6540	3844	Client.exe	133
PID 6540 wrote to memory of 1648	6540	CMD.exe	135
PID 3844 wrote to memory of 1916	3844	Client.exe	136
PID 1916 wrote to memory of 2536	1916	CMD.exe	138
PID 3844 wrote to memory of 3852	3844	Client.exe	139
PID 3824 wrote to memory of 4916	3824	xdwdMicrosoft Edge DevTools.exe	141
PID 3852 wrote to memory of 3468	3852	CMD.exe	142
PID 3844 wrote to memory of 2508	3844	Client.exe	143
PID 2508 wrote to memory of 6228	2508	CMD.exe	145
PID 3844 wrote to memory of 4768	3844	Client.exe	146
PID 4768 wrote to memory of 6396	4768	CMD.exe	148
PID 3844 wrote to memory of 5320	3844	Client.exe	149
PID 5320 wrote to memory of 892	5320	CMD.exe	151
PID 3844 wrote to memory of 5136	3844	Client.exe	152
PID 5136 wrote to memory of 4224	5136	CMD.exe	154
PID 3844 wrote to memory of 3688	3844	Client.exe	155
PID 3688 wrote to memory of 2476	3688	CMD.exe	157
PID 4916 wrote to memory of 6168	4916	xdwdGIMP Upgrade.exe	158
PID 6168 wrote to memory of 1452	6168	CMD.exe	160
PID 4916 wrote to memory of 2112	4916	xdwdGIMP Upgrade.exe	161
PID 2112 wrote to memory of 2636	2112	CMD.exe	163
PID 3844 wrote to memory of 2000	3844	Client.exe	164
PID 2000 wrote to memory of 4300	2000	CMD.exe	166
PID 4916 wrote to memory of 6492	4916	xdwdGIMP Upgrade.exe	167
PID 6492 wrote to memory of 4584	6492	CMD.exe	169
PID 3844 wrote to memory of 6340	3844	Client.exe	170
PID 6340 wrote to memory of 3660	6340	CMD.exe	172
PID 3844 wrote to memory of 4268	3844	Client.exe	173
PID 4268 wrote to memory of 5472	4268	CMD.exe	175
PID 3844 wrote to memory of 4572	3844	Client.exe	176
PID 4572 wrote to memory of 5616	4572	CMD.exe	178
PID 3844 wrote to memory of 2060	3844	Client.exe	179
PID 2060 wrote to memory of 5364	2060	CMD.exe	181
PID 3844 wrote to memory of 4720	3844	Client.exe	182
PID 4720 wrote to memory of 2760	4720	CMD.exe	184
PID 3844 wrote to memory of 5596	3844	Client.exe	185
PID 5596 wrote to memory of 6068	5596	CMD.exe	187
PID 3844 wrote to memory of 2584	3844	Client.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "explorer.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "explorer.exe" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5164
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6940
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:6500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:244

C:\Windows\xdwdMicrosoft Edge DevTools.exe
"C:\Windows\xdwdMicrosoft Edge DevTools.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\System32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe
  "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6168
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1452
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2636
- - C:\Windows\System32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6492
  - - C:\Windows\System32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Zoom.dll" /tr "C:\Users\Admin\AppData\Roaming\xdwdGIMP Upgrade.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3844-0-0x0000000000AA0000-0x0000000000B10000-memory.dmp

Download

memory/3844-1-0x00007FFFD969F000-0x00007FFFD96A0000-memory.dmp

Download

memory/3844-2-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download

memory/3844-3-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download

memory/3844-4-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download

memory/3844-5-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download

memory/3844-47-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download

memory/3844-148-0x00007FFFD9510000-0x00007FFFD9EB4000-memory.dmp

Download