sheetrat | 711501fd7f29b9cf03e0cf2de88b4938674067cfa9ed121a9de1ca71e46c55fb

Analysis

max time kernel
298s
max time network
302s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lastlasttest.exe
Size 335KB
Sample260924-q769aaef95
SHA256 711501fd7f29b9cf03e0cf2de88b4938674067cfa9ed121a9de1ca71e46c55fb
MD5 8ba05e2defff0a15ffd01b79cc98fabe
SHA1 45949e98d1bc1e5f5182575673a6a9d17b6cd4ea
SHA512 9799771bacebed00fea5545a1e478f8570eee83015a3cdb9e6c865ecd431e961b33a8710eefb577f2b266ffad2e385c30634be1e40016f3a4aab58f331c2acd8
SSDEEP 6144:i6BfA3mzXPoe6VlWT8cBHRLJJkpqIOA5beCe:vfiUXgPVle8cpRFqp0A4
TLSH
T15474E50CFE91E805CE2E3D77CBE610004B7165C26E219356324DAFFE8B5637658A66BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_refreshedoqvlhkxsapgzw execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Campaign

Sheet_Refreshedoqvlhkxsapgzw

bore.pub:34814

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/5380-0-0x0000000000B70000-0x0000000000BC8000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/5380-0-0x0000000000B70000-0x0000000000BC8000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Music\\Sub\\Client.exe"	lastlasttest.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 2 IoCs

pid	Process
5072	Client.exe
2488	WatchDog.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\oijdsaoijasdi08923489 = "C:\\Windows\\Sub\\WatchDog.exe"	lastlasttest.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Sub\WatchDog.exe	lastlasttest.exe
File opened for modification	C:\Windows\Sub\WatchDog.exe	lastlasttest.exe
File opened for modification	C:\Windows\Sub	WatchDog.exe
File opened for modification	C:\Windows\Sub	lastlasttest.exe
File created	C:\Windows\xdwd.dll	lastlasttest.exe
File opened for modification	C:\Windows\Sub\WatchDog.exe	WatchDog.exe
File opened for modification	C:\Windows\Sub\WatchDog.exe	Client.exe
File opened for modification	C:\Windows\Sub	Client.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	CMD.exe
5020	CMD.exe
6084	CMD.exe
5044	CMD.exe
5628	CMD.exe
5632	CMD.exe
3244	CMD.exe
4788	CMD.exe
5256	CMD.exe
2372	CMD.exe
2380	CMD.exe
5032	CMD.exe
4364	CMD.exe
5860	CMD.exe
1700	CMD.exe
3700	CMD.exe
3660	CMD.exe
696	CMD.exe
3812	CMD.exe
4376	CMD.exe
860	CMD.exe
4280	CMD.exe
4592	CMD.exe
5364	CMD.exe
4184	CMD.exe
4652	CMD.exe
4604	CMD.exe
5236	CMD.exe
2684	CMD.exe
760	CMD.exe
3176	CMD.exe
5692	CMD.exe
5568	CMD.exe
5116	CMD.exe
3408	CMD.exe
4048	CMD.exe
5792	CMD.exe
3204	CMD.exe
5352	CMD.exe
5676	CMD.exe
704	CMD.exe
716	CMD.exe
3044	CMD.exe
1080	CMD.exe
5136	CMD.exe
3724	CMD.exe
724	CMD.exe
2612	CMD.exe
3416	CMD.exe
5388	CMD.exe
3736	CMD.exe
2136	CMD.exe
1092	CMD.exe
5920	CMD.exe
3128	CMD.exe
4060	CMD.exe
2508	CMD.exe
4120	CMD.exe
5312	CMD.exe
1440	CMD.exe
968	CMD.exe
2032	CMD.exe
3320	CMD.exe
4568	CMD.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2420	schtasks.exe
5796	schtasks.exe
1664	schtasks.exe
3124	schtasks.exe
5436	schtasks.exe
4792	schtasks.exe
5216	schtasks.exe
4332	schtasks.exe
1620	schtasks.exe
2960	schtasks.exe
6008	schtasks.exe
3396	schtasks.exe
1104	schtasks.exe
2248	schtasks.exe
2984	schtasks.exe
3436	schtasks.exe
3124	schtasks.exe
4936	schtasks.exe
1840	schtasks.exe
2624	schtasks.exe
3932	schtasks.exe
3344	schtasks.exe
1136	schtasks.exe
4088	schtasks.exe
5024	schtasks.exe
3332	schtasks.exe
2784	schtasks.exe
5844	schtasks.exe
5148	schtasks.exe
468	schtasks.exe
4532	schtasks.exe
4360	schtasks.exe
4312	schtasks.exe
2680	schtasks.exe
4092	schtasks.exe
3676	schtasks.exe
2068	schtasks.exe
236	schtasks.exe
5352	schtasks.exe
1520	schtasks.exe
2952	schtasks.exe
5100	schtasks.exe
1280	schtasks.exe
5648	schtasks.exe
3320	schtasks.exe
5272	schtasks.exe
3208	schtasks.exe
1528	schtasks.exe
3464	schtasks.exe
3512	schtasks.exe
4028	schtasks.exe
3520	schtasks.exe
3980	schtasks.exe
1628	schtasks.exe
6124	schtasks.exe
1448	schtasks.exe
4244	schtasks.exe
2824	schtasks.exe
1780	schtasks.exe
2028	schtasks.exe
5600	schtasks.exe
4164	schtasks.exe
244	schtasks.exe
3396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
5380	lastlasttest.exe
2488	WatchDog.exe
2488	WatchDog.exe
2488	WatchDog.exe
2488	WatchDog.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5380	lastlasttest.exe
Token: SeDebugPrivilege	5072	Client.exe
Token: SeDebugPrivilege	2488	WatchDog.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5380 wrote to memory of 5256	5380	lastlasttest.exe	89
PID 5256 wrote to memory of 3124	5256	CMD.exe	91
PID 5380 wrote to memory of 3416	5380	lastlasttest.exe	92
PID 3416 wrote to memory of 4936	3416	CMD.exe	94
PID 5380 wrote to memory of 6116	5380	lastlasttest.exe	97
PID 6116 wrote to memory of 5100	6116	CMD.exe	99
PID 5380 wrote to memory of 4568	5380	lastlasttest.exe	102
PID 4568 wrote to memory of 1620	4568	CMD.exe	104
PID 5380 wrote to memory of 3336	5380	lastlasttest.exe	105
PID 3336 wrote to memory of 4408	3336	CMD.exe	107
PID 5380 wrote to memory of 3736	5380	lastlasttest.exe	113
PID 3736 wrote to memory of 1780	3736	CMD.exe	115
PID 5380 wrote to memory of 760	5380	lastlasttest.exe	116
PID 760 wrote to memory of 1628	760	CMD.exe	118
PID 5380 wrote to memory of 3176	5380	lastlasttest.exe	119
PID 3176 wrote to memory of 5124	3176	CMD.exe	121
PID 5380 wrote to memory of 2884	5380	lastlasttest.exe	122
PID 2884 wrote to memory of 468	2884	CMD.exe	124
PID 5380 wrote to memory of 1324	5380	lastlasttest.exe	125
PID 1324 wrote to memory of 4300	1324	CMD.exe	127
PID 2488 wrote to memory of 4048	2488	WatchDog.exe	128
PID 4048 wrote to memory of 1496	4048	CMD.exe	130
PID 5072 wrote to memory of 2372	5072	Client.exe	131
PID 2372 wrote to memory of 2480	2372	CMD.exe	133
PID 5380 wrote to memory of 5792	5380	lastlasttest.exe	134
PID 5792 wrote to memory of 1528	5792	CMD.exe	136
PID 5072 wrote to memory of 704	5072	Client.exe	137
PID 704 wrote to memory of 236	704	CMD.exe	139
PID 5380 wrote to memory of 4184	5380	lastlasttest.exe	140
PID 4184 wrote to memory of 5024	4184	CMD.exe	142
PID 5380 wrote to memory of 2380	5380	lastlasttest.exe	143
PID 2380 wrote to memory of 1280	2380	CMD.exe	145
PID 5380 wrote to memory of 1788	5380	lastlasttest.exe	146
PID 1788 wrote to memory of 4132	1788	CMD.exe	148
PID 5380 wrote to memory of 1080	5380	lastlasttest.exe	149
PID 1080 wrote to memory of 3332	1080	CMD.exe	151
PID 5380 wrote to memory of 1744	5380	lastlasttest.exe	152
PID 1744 wrote to memory of 3124	1744	CMD.exe	154
PID 5380 wrote to memory of 5032	5380	lastlasttest.exe	155
PID 5032 wrote to memory of 4532	5032	CMD.exe	157
PID 5380 wrote to memory of 2684	5380	lastlasttest.exe	158
PID 2684 wrote to memory of 5768	2684	CMD.exe	160
PID 5380 wrote to memory of 2612	5380	lastlasttest.exe	161
PID 2612 wrote to memory of 4272	2612	CMD.exe	163
PID 5380 wrote to memory of 4376	5380	lastlasttest.exe	164
PID 4376 wrote to memory of 1840	4376	CMD.exe	166
PID 5380 wrote to memory of 5136	5380	lastlasttest.exe	167
PID 5136 wrote to memory of 3200	5136	CMD.exe	169
PID 5380 wrote to memory of 4788	5380	lastlasttest.exe	170
PID 4788 wrote to memory of 3496	4788	CMD.exe	172
PID 5380 wrote to memory of 4120	5380	lastlasttest.exe	173
PID 4120 wrote to memory of 3520	4120	CMD.exe	175
PID 5380 wrote to memory of 3052	5380	lastlasttest.exe	176
PID 3052 wrote to memory of 3980	3052	CMD.exe	178
PID 5380 wrote to memory of 1040	5380	lastlasttest.exe	179
PID 1040 wrote to memory of 2784	1040	CMD.exe	181
PID 5380 wrote to memory of 860	5380	lastlasttest.exe	182
PID 860 wrote to memory of 4360	860	CMD.exe	184
PID 5380 wrote to memory of 4280	5380	lastlasttest.exe	185
PID 4280 wrote to memory of 3464	4280	CMD.exe	187
PID 5380 wrote to memory of 5692	5380	lastlasttest.exe	188
PID 5692 wrote to memory of 5352	5692	CMD.exe	190
PID 5380 wrote to memory of 5020	5380	lastlasttest.exe	191
PID 5020 wrote to memory of 5124	5020	CMD.exe	193

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\lastlasttest.exe
"C:\Users\Admin\AppData\Local\Temp\lastlasttest.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Delta" /tr "C:\Users\Admin\Music\Sub\Client.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Delta" /tr "C:\Users\Admin\Music\Sub\Client.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:5124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4300
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:5768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:3200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:3496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:5124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:5004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:3624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:4552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:2472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:3028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:4636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:2040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:3236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:2672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3660
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:4988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:5076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:2560
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:5596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:5912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:4824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:968
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:5204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:3280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:4524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:1360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332

C:\Users\Admin\Music\Sub\Client.exe
C:\Users\Admin\Music\Sub\Client.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:2480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:236

C:\Windows\Sub\WatchDog.exe
C:\Windows\Sub\WatchDog.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft Edge Services" /tr "C:\Users\Admin\Music\Sub\Client.exe" /RL HIGHEST
    3⤵
    PID:1496

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 135KB
SHA256 d2eb2730147de33b2450c9bb95ae65944077d560ff0fa619365103cacf8c10b4
MD5 7d28750e12afa4ede4c5f49cccd2d265
SHA1 babd93128d0f1ecf2e93ee83f9d6bce360af5e7b
SHA512 f64bc007f225f4c1e804c74410c884aa9c6e0edd8176b71e7a9116d53ac79dbd57398ed26c4b68d1cf367801360268b64fda08bda4b1d1c78546bb3f43dfc2e2
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MtWZpt:t07yDSvdoRj2Yp
TLSH
T1CBD34B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5380-0-0x0000000000B70000-0x0000000000BC8000-memory.dmp

Download

memory/5380-1-0x00007FFBB0ABF000-0x00007FFBB0AC0000-memory.dmp

Download

memory/5380-2-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download

memory/5380-3-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download

memory/5380-4-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download

memory/5380-5-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download

memory/5380-42-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download

memory/5380-117-0x00007FFBB0930000-0x00007FFBB12D4000-memory.dmp

Download