sheetrat | fe0e986d5cb5e754e98fbe1ff1cb0647c54188f29aee03ad339ccf278547e244

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 588KB
Sample260712-ten4saex2v
SHA256 fe0e986d5cb5e754e98fbe1ff1cb0647c54188f29aee03ad339ccf278547e244
MD5 8643dd12e3d5e2855502abdedf5baae4
SHA1 1766eabdf96bef71e4b06f1c0d313ae452dc42e6
SHA512 aea2d96bec790ffcf11637122d989a945b537532a32661e823deeef41232a185640da515f707e688a23dd60da6686a13787982e31ed408d8d6b9a04f77a28dae
SSDEEP 6144:ZEtAdTDcktQDF7X3r209URHrbSmHOaabBpLrlaNVdW58y8ZuAephj3iaDjX/+5+C:ZweLgJ3Y9bdCsNDW1CK1zLAn9
TLSH
T19AD4A30CBD92F805CF6E7DB3CBE2A4621B7210C27E129116270B6FF95B553B649A217C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.7

193.161.193.99:1194

Attributes

localhost
127.0.0.1:3765

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/1692-0-0x0000000000580000-0x000000000061A000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdDaVinci Resolve.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Loads dropped DLL 62 IoCs

pid	Process
4968	Process not Found
2088	Process not Found
3480	Process not Found
1444	Process not Found
3284	Process not Found
3272	Process not Found
3760	WmiApSrv.exe
4380	Process not Found
4648	Process not Found
744	Process not Found
4952	Process not Found
2384	Process not Found
2524	Process not Found
2080	Process not Found
3624	Process not Found
2612	Process not Found
60	Process not Found
1984	Process not Found
4320	Process not Found
5008	Process not Found
4856	Process not Found
688	Process not Found
1752	Process not Found
4424	Process not Found
3428	Process not Found
1276	Process not Found
2176	Process not Found
3380	Process not Found
3848	Process not Found
4880	Process not Found
1016	Process not Found
2520	Process not Found
4824	Process not Found
4268	Process not Found
1196	Process not Found
3432	Process not Found
1632	Process not Found
3736	Process not Found
4724	Process not Found
1192	Process not Found
3704	Process not Found
1552	Process not Found
1928	Process not Found
4628	Process not Found
2128	Process not Found
4736	Process not Found
5008	Process not Found
1216	Process not Found
3232	Process not Found
4084	Process not Found
4672	mspaint.exe
2676	svchost.exe
3608	OpenWith.exe
1832	Process not Found
456	Process not Found
2176	Process not Found
1880	Process not Found
1552	Process not Found
4084	Process not Found
4672	Process not Found
1436	Process not Found
4552	Process not Found

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\xdwdDaVinci Resolve.exe	Client.exe
File opened for modification	C:\Windows\xdwdDaVinci Resolve.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	mspaint.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 50 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3900	schtasks.exe
3932	schtasks.exe
1296	schtasks.exe
1228	schtasks.exe
1252	schtasks.exe
400	schtasks.exe
1292	schtasks.exe
1616	schtasks.exe
1612	schtasks.exe
4044	schtasks.exe
4636	schtasks.exe
2008	schtasks.exe
3960	schtasks.exe
3596	schtasks.exe
432	schtasks.exe
3812	schtasks.exe
3608	schtasks.exe
2520	schtasks.exe
4028	schtasks.exe
2400	schtasks.exe
1060	schtasks.exe
452	schtasks.exe
4036	schtasks.exe
3376	schtasks.exe
4596	schtasks.exe
1296	schtasks.exe
3352	schtasks.exe
4904	schtasks.exe
452	schtasks.exe
4644	schtasks.exe
1640	schtasks.exe
3480	schtasks.exe
2596	schtasks.exe
1484	schtasks.exe
4748	schtasks.exe
3368	schtasks.exe
4176	schtasks.exe
1752	schtasks.exe
3488	schtasks.exe
2272	schtasks.exe
4168	schtasks.exe
2528	schtasks.exe
4252	schtasks.exe
2120	schtasks.exe
1644	schtasks.exe
2164	schtasks.exe
2112	schtasks.exe
1732	schtasks.exe
2128	schtasks.exe
1640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
1692	Client.exe
3760	WmiApSrv.exe
3760	WmiApSrv.exe
4672	mspaint.exe
4672	mspaint.exe
4672	mspaint.exe
4672	mspaint.exe
2676	svchost.exe
2676	svchost.exe
3608	OpenWith.exe
3608	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4672	mspaint.exe
3608	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1432	1692	Client.exe	87
PID 1432 wrote to memory of 2272	1432	CMD.exe	89
PID 1692 wrote to memory of 2276	1692	Client.exe	90
PID 2276 wrote to memory of 4168	2276	CMD.exe	92
PID 1692 wrote to memory of 3816	1692	Client.exe	93
PID 3816 wrote to memory of 2528	3816	CMD.exe	95
PID 1692 wrote to memory of 2668	1692	Client.exe	100
PID 2668 wrote to memory of 3960	2668	CMD.exe	102
PID 1692 wrote to memory of 3124	1692	Client.exe	105
PID 3124 wrote to memory of 4596	3124	CMD.exe	107
PID 1692 wrote to memory of 4348	1692	Client.exe	108
PID 4348 wrote to memory of 1252	4348	CMD.exe	110
PID 1692 wrote to memory of 4548	1692	Client.exe	113
PID 4548 wrote to memory of 1296	4548	CMD.exe	115
PID 1692 wrote to memory of 388	1692	Client.exe	117
PID 388 wrote to memory of 400	388	CMD.exe	119
PID 1692 wrote to memory of 4980	1692	Client.exe	121
PID 4980 wrote to memory of 1292	4980	CMD.exe	123
PID 1692 wrote to memory of 864	1692	Client.exe	126
PID 864 wrote to memory of 4748	864	CMD.exe	128
PID 1692 wrote to memory of 3916	1692	Client.exe	129
PID 3916 wrote to memory of 3596	3916	CMD.exe	131
PID 1692 wrote to memory of 1488	1692	Client.exe	133
PID 1488 wrote to memory of 1616	1488	CMD.exe	135
PID 1692 wrote to memory of 3448	1692	Client.exe	137
PID 3448 wrote to memory of 1612	3448	CMD.exe	139
PID 1692 wrote to memory of 5036	1692	Client.exe	140
PID 5036 wrote to memory of 1732	5036	CMD.exe	142
PID 1692 wrote to memory of 512	1692	Client.exe	143
PID 512 wrote to memory of 432	512	CMD.exe	145
PID 1692 wrote to memory of 3920	1692	Client.exe	146
PID 3920 wrote to memory of 2128	3920	CMD.exe	148
PID 1692 wrote to memory of 744	1692	Client.exe	149
PID 744 wrote to memory of 3812	744	CMD.exe	151
PID 1692 wrote to memory of 4116	1692	Client.exe	152
PID 4116 wrote to memory of 4252	4116	CMD.exe	154
PID 1692 wrote to memory of 4468	1692	Client.exe	155
PID 4468 wrote to memory of 2120	4468	CMD.exe	157
PID 1692 wrote to memory of 4292	1692	Client.exe	158
PID 4292 wrote to memory of 452	4292	CMD.exe	160
PID 1692 wrote to memory of 3592	1692	Client.exe	161
PID 3592 wrote to memory of 1640	3592	CMD.exe	163
PID 1692 wrote to memory of 1520	1692	Client.exe	164
PID 1520 wrote to memory of 4644	1520	CMD.exe	166
PID 1692 wrote to memory of 4072	1692	Client.exe	167
PID 4072 wrote to memory of 3608	4072	CMD.exe	169
PID 1692 wrote to memory of 4780	1692	Client.exe	170
PID 4780 wrote to memory of 4044	4780	CMD.exe	172
PID 1692 wrote to memory of 4368	1692	Client.exe	173
PID 4368 wrote to memory of 3900	4368	CMD.exe	175
PID 1692 wrote to memory of 4604	1692	Client.exe	176
PID 4604 wrote to memory of 4636	4604	CMD.exe	178
PID 1692 wrote to memory of 2056	1692	Client.exe	179
PID 2056 wrote to memory of 1060	2056	CMD.exe	181
PID 1692 wrote to memory of 3836	1692	Client.exe	182
PID 3836 wrote to memory of 3368	3836	CMD.exe	184
PID 1692 wrote to memory of 3968	1692	Client.exe	185
PID 3968 wrote to memory of 1644	3968	CMD.exe	187
PID 1692 wrote to memory of 2172	1692	Client.exe	188
PID 2172 wrote to memory of 2164	2172	CMD.exe	190
PID 1692 wrote to memory of 4452	1692	Client.exe	191
PID 4452 wrote to memory of 2112	4452	CMD.exe	193
PID 1692 wrote to memory of 4196	1692	Client.exe	194
PID 4196 wrote to memory of 3352	4196	CMD.exe	196

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Dynamics Upgrade" /tr "C:\Windows\xdwdDaVinci Resolve.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Dynamics Upgrade" /tr "C:\Windows\xdwdDaVinci Resolve.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "KeePass" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Money.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "KeePass" /tr "C:\Users\Public\Pictures\xdwdMicrosoft Money.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1292
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2164
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:1132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:5084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:2108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:1944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:2660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:4556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:5112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST & exit
  2⤵
  PID:3336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Dropbox" /tr "C:\Windows\xdwdDaVinci Resolve.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SelectResume.jpeg" /ForceBootstrapPaint3D
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-96-0x000000001B8E0000-0x000000001B8F0000-memory.dmp

Download

memory/1692-7-0x000000001B8E0000-0x000000001B8F0000-memory.dmp

Download

memory/1692-0-0x0000000000580000-0x000000000061A000-memory.dmp

Download

memory/2676-1098-0x0000025A548A0000-0x0000025A548A1000-memory.dmp

Download

memory/2676-1096-0x0000025A54890000-0x0000025A54891000-memory.dmp

Download

memory/2676-1185-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/2676-1079-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/2676-1080-0x0000025A44460000-0x0000025A44470000-memory.dmp

Download

memory/2676-1084-0x0000025A44660000-0x0000025A44670000-memory.dmp

Download

memory/2676-1091-0x0000025A54780000-0x0000025A54781000-memory.dmp

Download

memory/2676-1093-0x0000025A54800000-0x0000025A54801000-memory.dmp

Download

memory/2676-1095-0x0000025A54800000-0x0000025A54801000-memory.dmp

Download

memory/2676-1099-0x0000025A548A0000-0x0000025A548A1000-memory.dmp

Download

memory/2676-1097-0x0000025A54890000-0x0000025A54891000-memory.dmp

Download

memory/3608-1102-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/3608-1186-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/3760-67-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/3760-124-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/4672-1103-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download

memory/4672-1077-0x00007FFAB4290000-0x00007FFAB42B2000-memory.dmp

Download