sheetrat | 38361a763d98f583bc2e4bd85419886730aac4c7fb819cbbb7a060664d5030ac

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_ad29e451dd2104fdb91464ddb7b420f4_akira_rusty-stealer.exe
Size 480KB
Sample260724-zel73ssfjg
SHA256 38361a763d98f583bc2e4bd85419886730aac4c7fb819cbbb7a060664d5030ac
MD5 ad29e451dd2104fdb91464ddb7b420f4
SHA1 4c226283257e23821f17235596daa15f1c001c26
SHA512 03716e8e5f983c27485e5c31157318b20079dac8ee7e4a0c40160d5cdc9d52880a9f637d68de83682d8198ff7a710c1adc41355a510d102b00416db6c291d5a5
SSDEEP 6144:oDVjuSBCvD98/N36hVGt1b5MqHBgfQqxSjabO8mPXub91m1TbsZmEdbKzauvBAa2:y498/V6hVsb5MqHtjM61n9Edqvp3CYZ
TLSH
T1E4A45A8D691246F2E738047E57D6C3591F12A0B82512337B083B90F5CB6FF9A47B7A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_hhjmnjytouocaam execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_hhjmnjytouocaam

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000e00000001c4df-2.dat	family_sheetrat_v4
behavioral2/memory/4732-4-0x0000000000580000-0x00000000005E0000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4df-2.dat	Sheetrat_v5
behavioral2/memory/4732-4-0x0000000000580000-0x00000000005E0000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\xdwdBlender.exe"	tmp_exec.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
4732	tmp_exec.exe
3720	xdwdPaint.NET.exe
5460	xdwdBlender.exe

Loads dropped DLL 49 IoCs

pid	Process
1620	Process not Found
1772	Process not Found
4180	Process not Found
696	Process not Found
1060	Process not Found
2664	Process not Found
2404	Process not Found
3720	xdwdPaint.NET.exe
5460	xdwdBlender.exe
2908	Process not Found
1392	Process not Found
1080	Process not Found
5620	Process not Found
4296	Process not Found
6128	Process not Found
2484	Process not Found
1980	Process not Found
1936	Process not Found
5860	Process not Found
1544	Process not Found
3160	Process not Found
620	Process not Found
4380	Process not Found
2724	Process not Found
1840	Process not Found
3268	Process not Found
1316	Process not Found
2188	Process not Found
1244	Process not Found
3624	Process not Found
852	Process not Found
5412	Process not Found
2560	Process not Found
1836	Process not Found
6068	Process not Found
3260	Process not Found
1608	Process not Found
4092	Process not Found
2232	Process not Found
2352	Process not Found
2528	Process not Found
2568	Process not Found
3912	Process not Found
2576	Process not Found
5960	Process not Found
4124	Process not Found
2004	Process not Found
1564	Process not Found
400	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	tmp_exec.exe

Executes a command shell one-liner 1 TTPs 47 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2192	CMD.exe
5968	CMD.exe
4204	CMD.exe
612	CMD.exe
2616	CMD.exe
2360	CMD.exe
3056	CMD.exe
1876	CMD.exe
5644	CMD.exe
3236	CMD.exe
1704	CMD.exe
4608	CMD.exe
1812	CMD.exe
3376	CMD.exe
6124	CMD.exe
5108	CMD.exe
3868	CMD.exe
6072	CMD.exe
5456	CMD.exe
3348	CMD.exe
4284	CMD.exe
1228	CMD.exe
4768	CMD.exe
2484	CMD.exe
2052	CMD.exe
992	CMD.exe
4848	CMD.exe
3796	CMD.exe
1604	CMD.exe
5160	CMD.exe
5228	CMD.exe
3128	CMD.exe
1768	CMD.exe
5692	CMD.exe
4988	CMD.exe
696	CMD.exe
3780	CMD.exe
628	CMD.exe
4852	CMD.exe
1004	CMD.exe
3420	CMD.exe
3628	CMD.exe
5040	CMD.exe
5788	CMD.exe
236	CMD.exe
1240	CMD.exe
1576	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 47 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4500	schtasks.exe
2760	schtasks.exe
1800	schtasks.exe
1200	schtasks.exe
5716	schtasks.exe
3296	schtasks.exe
1752	schtasks.exe
2540	schtasks.exe
1284	schtasks.exe
6056	schtasks.exe
5452	schtasks.exe
2784	schtasks.exe
4816	schtasks.exe
2452	schtasks.exe
776	schtasks.exe
864	schtasks.exe
6084	schtasks.exe
3724	schtasks.exe
1352	schtasks.exe
5784	schtasks.exe
3736	schtasks.exe
4604	schtasks.exe
5848	schtasks.exe
1568	schtasks.exe
5400	schtasks.exe
1060	schtasks.exe
4688	schtasks.exe
3324	schtasks.exe
1092	schtasks.exe
5308	schtasks.exe
3544	schtasks.exe
5956	schtasks.exe
5620	schtasks.exe
4828	schtasks.exe
5244	schtasks.exe
1576	schtasks.exe
1400	schtasks.exe
2036	schtasks.exe
3520	schtasks.exe
960	schtasks.exe
5688	schtasks.exe
2352	schtasks.exe
4128	schtasks.exe
5440	schtasks.exe
2588	schtasks.exe
4928	schtasks.exe
5732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3720	xdwdPaint.NET.exe
3720	xdwdPaint.NET.exe
3720	xdwdPaint.NET.exe
3720	xdwdPaint.NET.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	tmp_exec.exe
Token: SeDebugPrivilege	3720	xdwdPaint.NET.exe
Token: SeDebugPrivilege	5460	xdwdBlender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4732	3676	2026-07-24_ad29e451dd2104fdb91464ddb7b420f4_akira_rusty-stealer.exe	88
PID 4732 wrote to memory of 3868	4732	tmp_exec.exe	90
PID 3868 wrote to memory of 4828	3868	CMD.exe	92
PID 4732 wrote to memory of 5968	4732	tmp_exec.exe	93
PID 5968 wrote to memory of 1800	5968	CMD.exe	95
PID 4732 wrote to memory of 3628	4732	tmp_exec.exe	96
PID 3628 wrote to memory of 776	3628	CMD.exe	98
PID 4732 wrote to memory of 3128	4732	tmp_exec.exe	101
PID 3128 wrote to memory of 864	3128	CMD.exe	103
PID 4732 wrote to memory of 5040	4732	tmp_exec.exe	104
PID 5040 wrote to memory of 5244	5040	CMD.exe	106
PID 4732 wrote to memory of 5788	4732	tmp_exec.exe	107
PID 5788 wrote to memory of 1576	5788	CMD.exe	109
PID 4732 wrote to memory of 6072	4732	tmp_exec.exe	111
PID 6072 wrote to memory of 1400	6072	CMD.exe	113
PID 4732 wrote to memory of 4768	4732	tmp_exec.exe	116
PID 4768 wrote to memory of 2784	4768	CMD.exe	118
PID 4732 wrote to memory of 4204	4732	tmp_exec.exe	119
PID 4204 wrote to memory of 4816	4204	CMD.exe	121
PID 4732 wrote to memory of 5456	4732	tmp_exec.exe	122
PID 5456 wrote to memory of 3296	5456	CMD.exe	124
PID 4732 wrote to memory of 1812	4732	tmp_exec.exe	125
PID 1812 wrote to memory of 6084	1812	CMD.exe	127
PID 4732 wrote to memory of 992	4732	tmp_exec.exe	128
PID 992 wrote to memory of 2352	992	CMD.exe	130
PID 3720 wrote to memory of 1768	3720	xdwdPaint.NET.exe	131
PID 1768 wrote to memory of 5848	1768	CMD.exe	133
PID 5460 wrote to memory of 5692	5460	xdwdBlender.exe	134
PID 5692 wrote to memory of 1568	5692	CMD.exe	136
PID 4732 wrote to memory of 4848	4732	tmp_exec.exe	137
PID 4848 wrote to memory of 1092	4848	CMD.exe	139
PID 5460 wrote to memory of 3348	5460	xdwdBlender.exe	140
PID 3348 wrote to memory of 5308	3348	CMD.exe	142
PID 4732 wrote to memory of 4988	4732	tmp_exec.exe	143
PID 4988 wrote to memory of 2036	4988	CMD.exe	145
PID 4732 wrote to memory of 4284	4732	tmp_exec.exe	146
PID 4284 wrote to memory of 2452	4284	CMD.exe	148
PID 4732 wrote to memory of 612	4732	tmp_exec.exe	149
PID 612 wrote to memory of 4128	612	CMD.exe	151
PID 4732 wrote to memory of 236	4732	tmp_exec.exe	152
PID 236 wrote to memory of 3544	236	CMD.exe	154
PID 4732 wrote to memory of 1240	4732	tmp_exec.exe	155
PID 1240 wrote to memory of 5400	1240	CMD.exe	157
PID 4732 wrote to memory of 2616	4732	tmp_exec.exe	158
PID 2616 wrote to memory of 3724	2616	CMD.exe	160
PID 4732 wrote to memory of 3796	4732	tmp_exec.exe	161
PID 3796 wrote to memory of 1352	3796	CMD.exe	163
PID 4732 wrote to memory of 696	4732	tmp_exec.exe	164
PID 696 wrote to memory of 3520	696	CMD.exe	166
PID 4732 wrote to memory of 2360	4732	tmp_exec.exe	167
PID 2360 wrote to memory of 5956	2360	CMD.exe	169
PID 4732 wrote to memory of 1004	4732	tmp_exec.exe	170
PID 1004 wrote to memory of 1060	1004	CMD.exe	172
PID 4732 wrote to memory of 3420	4732	tmp_exec.exe	173
PID 3420 wrote to memory of 5784	3420	CMD.exe	175
PID 4732 wrote to memory of 2192	4732	tmp_exec.exe	176
PID 2192 wrote to memory of 1752	2192	CMD.exe	178
PID 4732 wrote to memory of 1576	4732	tmp_exec.exe	179
PID 1576 wrote to memory of 4688	1576	CMD.exe	181
PID 4732 wrote to memory of 1228	4732	tmp_exec.exe	182
PID 1228 wrote to memory of 5440	1228	CMD.exe	184
PID 4732 wrote to memory of 5644	4732	tmp_exec.exe	185
PID 5644 wrote to memory of 960	5644	CMD.exe	187
PID 4732 wrote to memory of 3056	4732	tmp_exec.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-24_ad29e451dd2104fdb91464ddb7b420f4_akira_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_ad29e451dd2104fdb91464ddb7b420f4_akira_rusty-stealer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\tmp_exec.exe
  C:\Users\Admin\AppData\Local\Temp\tmp_exec.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft PowerPoint Host" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4828
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1800
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics" /tr "C:\Users\Admin\Videos\xdwdPaint.NET.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Dynamics" /tr "C:\Users\Admin\Videos\xdwdPaint.NET.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:776
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:864
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5244
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1576
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1400
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2784
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4816
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5456
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3296
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6084
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2352
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1092
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2036
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2452
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3544
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5400
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3724
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1352
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3520
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2360
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5956
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1060
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5784
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1752
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4688
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5440
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:960
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3056
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5688
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3236
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2540
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3780
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2588
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1604
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1284
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:3376
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4928
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1876
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5620
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1704
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5732
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2484
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4500
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:628
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6056
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:6124
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1200
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5160
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5716
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4852
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3736
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5228
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3324
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4608
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5452
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5108
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4604
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:2052
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2760

C:\Users\Admin\Videos\xdwdPaint.NET.exe
C:\Users\Admin\Videos\xdwdPaint.NET.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5848

C:\Users\Admin\AppData\Roaming\xdwdBlender.exe
C:\Users\Admin\AppData\Roaming\xdwdBlender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Docker" /tr "C:\Users\Admin\AppData\Roaming\xdwdBlender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp_exec.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp_exec.exe
Size 357KB
SHA256 e1bf9f3998794b423dffe1c52cd20c7875d7266a6550131f1ce6c69b57de3e19
MD5 e8e84a8300fed6b49f716371f13e2b97
SHA1 06b9ae724546be20f5bbdf69fc15dbc66b7ee0c2
SHA512 05623b85da1e0c047ed269ab1098a804cbd41bfc6da981af38ed7e823dc2ef85981530c47e5eda633752f6aad2b89c8283406e6756ae56ad8dd412d18726f459
SSDEEP 6144:c6HGdUF9pvPce6VlWT8b9I77nH5i25bzIngu25OcI:H9F9qPVle8OHhIgOcI
TLSH
T19074B40CFE91E805CE5E3D77CFE610008B7125C26E219246355AAFFD8B6937758A62BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4732-5-0x00007FFDE8B7F000-0x00007FFDE8B80000-memory.dmp

Download

memory/4732-4-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4732-6-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4732-7-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4732-8-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4732-9-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4732-41-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download

memory/4732-126-0x00007FFDE89F0000-0x00007FFDE9394000-memory.dmp

Download