growtopia | 5a52085a5f8f591347e11bc4c9246887ebe5dcde0209edc7016e3d6000f1defa

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-02-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlitzWare_Fortnite_Menu/BlitzWare.exe
Size

12.8MB
MD5

3b4a760c064fa2e6f5b05c9da03333c6
SHA1

8053af5d5858430a3b6f28ad3c8c5be47932dd5d
SHA256

bc2d16deb9222945b10f9511c777d7125042d31d748a0f42affc8a659f2dac79
SHA512

54399f1198a15e52d04d0d8a0f59ccfeec067ccf331393a1311bb81b6f034449c42ec02fe3811f827847b93916a2264408035c49946e598368bb9a9278cdba0a
SSDEEP

196608:Ob5hSxqJAcXCMEKngteZX07mvbSHL8D++wsmReLZijeBCMcwJADXbsdMN2LId+3B:Obmq7yMERtD2bysmMijstOX422cdK

Score

10^/10

growtopia xmrig zgrat evasion miner persistence pyinstaller rat stealer upx

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2540-46-0x00000000005C0000-0x000000000062C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-74-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-83-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-93-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-103-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-113-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-117-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-121-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-125-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-135-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-133-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-131-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-129-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-127-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-123-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-119-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-115-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-111-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-109-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-107-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-105-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-101-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-99-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-97-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-95-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-91-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-89-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-87-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-85-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-81-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-79-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-77-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-70-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1
behavioral1/memory/2540-68-0x00000000005C0000-0x0000000000625000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1140-1704-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1140-1713-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeKeyGeneratorI.exeWinErrorMgr.exebauwrdgwodhv.exe

pid	process
2540	Ilkdt.exe
2936	WinHostMgr.exe
2660	WinErrorMgr.exe
2080	KeyGeneratorI.exe
2688	Sahyui1337.exe
2796	KeyGeneratorI.exe
2036	WinErrorMgr.exe
480
1524	bauwrdgwodhv.exe

Loads dropped DLL 10 IoCs

Processes:

BlitzWare.exeKeyGeneratorI.exeKeyGeneratorI.exeWinErrorMgr.exe

pid	process
2904	BlitzWare.exe
2904	BlitzWare.exe
2904	BlitzWare.exe
2904	BlitzWare.exe
2904	BlitzWare.exe
2904	BlitzWare.exe
2080	KeyGeneratorI.exe
2796	KeyGeneratorI.exe
2660	WinErrorMgr.exe
480

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1140-1704-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1140-1713-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

2 discord.com
3 discord.com
9 pastebin.com
10 pastebin.com

flow	ioc
2	discord.com
3	discord.com
9	pastebin.com
10	pastebin.com

Drops file in System32 directory 3 IoCs

Processes:

powershell.exebauwrdgwodhv.exeWinHostMgr.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1524 set thread context of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 set thread context of 1140	1524	bauwrdgwodhv.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

wusa.exewusa.exe

description ioc process

File created C:\Windows\wusa.lock wusa.exe
File created C:\Windows\wusa.lock wusa.exe

description	ioc	process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
2940	sc.exe
1104	sc.exe
900	sc.exe
1952	sc.exe
2588	sc.exe
2440	sc.exe
2696	sc.exe
1960	sc.exe
2136	sc.exe
2772	sc.exe
1592	sc.exe
2432	sc.exe
2584	sc.exe
1736	sc.exe

Detects Pyinstaller 5 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1692 schtasks.exe

pid	process
1692	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 806e723a1357da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeSahyui1337.exeWinHostMgr.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
2208	powershell.exe
2688	Sahyui1337.exe
2688	Sahyui1337.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
2936	WinHostMgr.exe
1524	bauwrdgwodhv.exe
2632	powershell.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1524	bauwrdgwodhv.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe
1140	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Ilkdt.exepowershell.exeSahyui1337.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2540	Ilkdt.exe
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeDebugPrivilege	2688	Sahyui1337.exe
Token: SeShutdownPrivilege	1332	powercfg.exe
Token: SeShutdownPrivilege	2720	powercfg.exe
Token: SeShutdownPrivilege	2840	powercfg.exe
Token: SeShutdownPrivilege	2740	powercfg.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeShutdownPrivilege	1640	powercfg.exe
Token: SeShutdownPrivilege	1224	powercfg.exe
Token: SeShutdownPrivilege	664	powercfg.exe
Token: SeShutdownPrivilege	3044	powercfg.exe
Token: SeLockMemoryPrivilege	1140	explorer.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

BlitzWare.exeKeyGeneratorI.exeWinErrorMgr.exeWinErrorMgr.execmd.execmd.exebauwrdgwodhv.exe

description	pid	process	target process
PID 2904 wrote to memory of 2208	2904	BlitzWare.exe	powershell.exe
PID 2904 wrote to memory of 2208	2904	BlitzWare.exe	powershell.exe
PID 2904 wrote to memory of 2208	2904	BlitzWare.exe	powershell.exe
PID 2904 wrote to memory of 2208	2904	BlitzWare.exe	powershell.exe
PID 2904 wrote to memory of 2540	2904	BlitzWare.exe	Ilkdt.exe
PID 2904 wrote to memory of 2540	2904	BlitzWare.exe	Ilkdt.exe
PID 2904 wrote to memory of 2540	2904	BlitzWare.exe	Ilkdt.exe
PID 2904 wrote to memory of 2540	2904	BlitzWare.exe	Ilkdt.exe
PID 2904 wrote to memory of 2936	2904	BlitzWare.exe	WinHostMgr.exe
PID 2904 wrote to memory of 2936	2904	BlitzWare.exe	WinHostMgr.exe
PID 2904 wrote to memory of 2936	2904	BlitzWare.exe	WinHostMgr.exe
PID 2904 wrote to memory of 2936	2904	BlitzWare.exe	WinHostMgr.exe
PID 2904 wrote to memory of 2660	2904	BlitzWare.exe	WinErrorMgr.exe
PID 2904 wrote to memory of 2660	2904	BlitzWare.exe	WinErrorMgr.exe
PID 2904 wrote to memory of 2660	2904	BlitzWare.exe	WinErrorMgr.exe
PID 2904 wrote to memory of 2660	2904	BlitzWare.exe	WinErrorMgr.exe
PID 2904 wrote to memory of 2080	2904	BlitzWare.exe	KeyGeneratorI.exe
PID 2904 wrote to memory of 2080	2904	BlitzWare.exe	KeyGeneratorI.exe
PID 2904 wrote to memory of 2080	2904	BlitzWare.exe	KeyGeneratorI.exe
PID 2904 wrote to memory of 2080	2904	BlitzWare.exe	KeyGeneratorI.exe
PID 2904 wrote to memory of 2688	2904	BlitzWare.exe	Sahyui1337.exe
PID 2904 wrote to memory of 2688	2904	BlitzWare.exe	Sahyui1337.exe
PID 2904 wrote to memory of 2688	2904	BlitzWare.exe	Sahyui1337.exe
PID 2904 wrote to memory of 2688	2904	BlitzWare.exe	Sahyui1337.exe
PID 2080 wrote to memory of 2796	2080	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2080 wrote to memory of 2796	2080	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2080 wrote to memory of 2796	2080	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2660 wrote to memory of 2036	2660	WinErrorMgr.exe	WinErrorMgr.exe
PID 2660 wrote to memory of 2036	2660	WinErrorMgr.exe	WinErrorMgr.exe
PID 2660 wrote to memory of 2036	2660	WinErrorMgr.exe	WinErrorMgr.exe
PID 2660 wrote to memory of 2036	2660	WinErrorMgr.exe	WinErrorMgr.exe
PID 2036 wrote to memory of 1692	2036	WinErrorMgr.exe	schtasks.exe
PID 2036 wrote to memory of 1692	2036	WinErrorMgr.exe	schtasks.exe
PID 2036 wrote to memory of 1692	2036	WinErrorMgr.exe	schtasks.exe
PID 2036 wrote to memory of 1692	2036	WinErrorMgr.exe	schtasks.exe
PID 2004 wrote to memory of 2652	2004	cmd.exe	wusa.exe
PID 2004 wrote to memory of 2652	2004	cmd.exe	wusa.exe
PID 2004 wrote to memory of 2652	2004	cmd.exe	wusa.exe
PID 2276 wrote to memory of 2416	2276	cmd.exe	wusa.exe
PID 2276 wrote to memory of 2416	2276	cmd.exe	wusa.exe
PID 2276 wrote to memory of 2416	2276	cmd.exe	wusa.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1740	1524	bauwrdgwodhv.exe	conhost.exe
PID 1524 wrote to memory of 1140	1524	bauwrdgwodhv.exe	explorer.exe
PID 1524 wrote to memory of 1140	1524	bauwrdgwodhv.exe	explorer.exe
PID 1524 wrote to memory of 1140	1524	bauwrdgwodhv.exe	explorer.exe
PID 1524 wrote to memory of 1140	1524	bauwrdgwodhv.exe	explorer.exe
PID 1524 wrote to memory of 1140	1524	bauwrdgwodhv.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAbABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAdwB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAaQBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2652
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2584
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2588
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2440
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:2696
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:2772
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2940
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1736
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1592
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9943.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1692
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2796
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2688

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1740
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:900
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2136
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
- Drops file in Windows directory
PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
968KB

MD5
fec66a5548887002ee58dd80346d04a0

SHA1
894bc833c64c420d70d3a510642063c290111aaf

SHA256
729e58661b6e1e20937f9a527f2c19aa3524e34e8f433cf7116752b93848e63a

SHA512
0cc8ab08760a59023cb780bcf3e85f76a310095427ec691939b0b0dae4fe4b4849051f0867633e1a2e439972a5e7297d8c904ca0ec8ccc6447a8ee7accbe1b24

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
649KB

MD5
b28a8ed7d01f4b011634ec1f069ae548

SHA1
898903a0fcb6fd7b90c73bf9d0aedd11eceaec15

SHA256
6e034ce6d529ed3995e6f714dc49b07359c9faba281244d628cbef75f863ee6d

SHA512
647d61a08e3be6649515ac71831e659929763745ffc141cd4fe2e45cdeafebc5d3b0b6348ed4fdd0216802647cda102bf368627b9cb5348d80cb620cf9ef5328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
735KB

MD5
ab0a32661d8c5b06fb66f121d5fabc9b

SHA1
333470eca70f6fc89a48d89f6cf253f1ba61aaf8

SHA256
21e7dc02cd03fc895928cd5d06b5f147c8350bb60ce7105b11dac2ea0370ad46

SHA512
81121c69025d992957c5776b8d814bc772610a47d758d2e6a8bb7074627d58edf65044375ee36bddfd422d580606d80096a9b3108509812bb8adc38805d442b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
857KB

MD5
7da6591a51b008a08359a62718196d19

SHA1
2dfb15c71a190aa38670837cc109323fc9c5d5a2

SHA256
31970c5af7ba854ffb1cb1c51a6dade72c2b248612b318a401b5cf444cd5d371

SHA512
6a675be0539f4f9316a50d31cbc0ff999c5eca4d97f0941014396e30d39bb8d6f01aa28edd2d394546613458c2774aac2892a12ae84107bc3f94cc2494aaa4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.9MB

MD5
398154e40b92c0e51f36d2e96197df10

SHA1
1bea00ef268bd4dc1dcdf010d7ab7560da652694

SHA256
8d748b498856cfe0553bfa5c504520bf074b9a79bffde36eca80aec83a155f5a

SHA512
0070fca113ddaf011a4adf4a3926324f369f7267a47995064faa61a7ae95eb92aad1dc8da88f093bdb739e96ecf7cdd36df785a1302aecadc9660e8f3c8569fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20802\python312.dll

Filesize
314KB

MD5
a53938a8d33f20eb7b43192bc44cf8ef

SHA1
52c5fab8d6f204fe26b466918718370fcbf4d6e4

SHA256
410d21f0002e00f58b87159edcddd4504b03f6fdebab14de65b34b342d395dc5

SHA512
9cdc038a1b77473fb501e789bf510002eb02aba9e063b7ebf734451800189fb341ff8b3d9345b0376509348f35edbad673efd78004f12bace99473b81573ddd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9943.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
262KB

MD5
f6a9dd6f7a3a1beda9b07fdce450ab69

SHA1
79680ca37c048aa0b45d348a031442d417b62bf1

SHA256
b1cca0e52f645807093054d5a4939e1cc394e784a357443f7a3e87423fe373d1

SHA512
8ab4930defefbfc72bd5af8041436921d28833f627d4133399fa6f147a86e4beaedad857d12f0ce5de8d674f8a5d7f8a254373f67925db1f573285cfe552de83

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
366KB

MD5
5b557c6f9b40994308efd70e455983e2

SHA1
f14aa9ab6ad7d49cdd37ebab073345a31c896c9d

SHA256
e8474a6b406af8a192d1b45ac0ea16ba473e7203da482f02759f20ed59277cfa

SHA512
e96d329a042d1e98ac1ac9b7365ddcb238e2f8840b5f690650e00825b9a1804dbd643436110c1b8f41093a209cdb754d651c33724c65aaaddd90c89ea4347776

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
164KB

MD5
848bbf3d0f5d8769b85a37fd2fc6e373

SHA1
a0eda2e0437b80773e738872c4365b153ec6f744

SHA256
cf514c611fc97dd2bf07219d9e9084fa7d84899b039698312c15feee8dcc997b

SHA512
582e757065bf3014a853134be53e50bebd7db21df33840034935431af37fa477bb052854dcd9c762580ba7598196f22e4cfbda48e894cd537782ff0c992df003

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
920KB

MD5
1fa97b34a48a4fb68ef23c2b5b37fda8

SHA1
244bc1acd1d8465c720b7967051cb7823e608ff3

SHA256
7016e6a73b87ac7bb69a202cd817194b93e70ae217b621146b83f22fbc124f77

SHA512
17226fb05be6080cab1179dbd3e03a3552b73bb578a5297bbcb27a4008ce4159942d16e44f3a2519b728bf980124b38d4890807d5d8bcad9b1a30dc8c0757c02

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.0MB

MD5
70afba1bb5ad0e9f2885934f8201d465

SHA1
e47082356c4f1bc737aa95e967d249157f46c78d

SHA256
d72ecc8af6c9f776aed3f51e34bed48d57652cc44c860bed219d81947c0ef626

SHA512
220bb2771af2dbc068fee152ccac9e495f830ca37f8116f29e3080b86a5dcf86de66eb319897702c2183c1a619ae2435f3fa83d1e6ada8a4116ad15d869a0b35

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
238KB

MD5
a0a876e4afd9f7d24320eceba12cef5d

SHA1
1b52bd1ee3295c467d8ce0361d907db2114f6045

SHA256
e91e5f851d2d3c352c3630f725600d7e039ab058fed6c56e262859c57c174337

SHA512
6409e0e108d43897d7ad9ff45b066d772bc1c295d167d3db73618dac01c2d9640631d815a784cf46f7b20bff049c2137d75a54c817da6281a9d5d44fa762a94c

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
682KB

MD5
ca7c5f22e4f3c9d20b908087f57d9355

SHA1
155d5a5e53e7b7d494e72bf7b7a574da020eb68d

SHA256
11a9271dab2f3bd9b2f8afad9458a1f7131b5b3eeddd5ab189921bb9288fcb0c

SHA512
feaa55f65d8599bfb8f7fa113651dca4c4a4e5d2f3138f8f89212a022971b77f248f578e258922a72de9b4d043c29ac6737eb91e13eefe5f4e2574b07edcf8af

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
977KB

MD5
27765ff746a8b1cab4a004dbc9e84c75

SHA1
e9288cf86cf272665e5f33a63d3cbe9afb5cefa2

SHA256
0aff13b928f2c28365061ac7667835432db5332d0b3c7be88422d0558383951b

SHA512
f0dedd778c8f0b7cefd06630c1a2977af12236fc0f91241bc357f711ae11a0004c1e8da5b89658eb2b173bbf9326188c857fec7c42a21c99265eb687f412b5f3

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI20802\python312.dll

Filesize
101KB

MD5
4fc685682162a1980e280595dc2e29be

SHA1
fe10f960f46f21058a936745ee6188c7911abfe7

SHA256
cbb2c788acc408992f93145676f8f94a422806f312774e638294b1e9975d3125

SHA512
03be371a514f719f99c1d8918e10d04b2fae53bb413be62feea38cd781b2947c72d25ca8c405fffa68e898e0f45f0d546eece91f48e4cc4445f516500f6fa96d

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
238KB

MD5
6b5ca060e133eb1efc332373a1a18f63

SHA1
545bd3b9f392ba1519dde2fe55df42b43c721ca9

SHA256
bcb488b78d409796c7127382a4cdb648f440e7bfdac3f2617e1952b24b42953c

SHA512
97a529293f557938aa50e14a83fd0385a7962ee1f63e1b1e49034c45226ef544ae31de95d5caa1d3a726bd0d06ae59474859feff77f9c27bf27e5d271c6bb23f

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
213KB

MD5
e0b45aa8054cbd7c6b6bff1053e480b4

SHA1
49b66e61763beae8c38969b0e2aeeb18f5a8b838

SHA256
a97eb60df17381d0c4d97b0fc2c702eb57f71550fd61f1c63c63cace44ee8cae

SHA512
39cfbdf3f3097558e47bd79986f1e42930f297d375119f04f712120259fd534a3b6c279262a8ee1f3d630ddf7a7929373cdb4c54797e25a0788a57c1e236344d

Download Submit
memory/1140-1713-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1140-1704-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1140-1712-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/1140-1714-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/2036-67-0x0000000001310000-0x0000000001320000-memory.dmp

Filesize
64KB

Download
memory/2036-1672-0x00000000011E0000-0x0000000001220000-memory.dmp

Filesize
256KB

Download
memory/2036-1670-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2036-1669-0x00000000011E0000-0x0000000001220000-memory.dmp

Filesize
256KB

Download
memory/2036-75-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2208-69-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2208-64-0x0000000073480000-0x0000000073A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-55-0x0000000073480000-0x0000000073A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2208-58-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2208-73-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2208-1267-0x0000000073480000-0x0000000073A2B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-70-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-115-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-123-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-24-0x0000000001030000-0x0000000001066000-memory.dmp

Filesize
216KB

Download
memory/2540-113-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-111-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-109-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-107-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-105-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-101-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-99-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-129-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-97-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-95-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-91-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-89-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-87-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-85-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-81-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-79-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-77-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-117-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-121-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-68-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-42-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2540-127-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-119-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-131-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-1666-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2540-103-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-93-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-83-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-46-0x00000000005C0000-0x000000000062C000-memory.dmp

Filesize
432KB

Download
memory/2540-74-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-133-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-71-0x00000000046B0000-0x00000000046F0000-memory.dmp

Filesize
256KB

Download
memory/2540-125-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2540-135-0x00000000005C0000-0x0000000000625000-memory.dmp

Filesize
404KB

Download
memory/2632-1686-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2632-1683-0x0000000001580000-0x0000000001600000-memory.dmp

Filesize
512KB

Download
memory/2632-1681-0x00000000005A0000-0x00000000005A8000-memory.dmp

Filesize
32KB

Download
memory/2632-1680-0x0000000001580000-0x0000000001600000-memory.dmp

Filesize
512KB

Download
memory/2632-1685-0x0000000001580000-0x0000000001600000-memory.dmp

Filesize
512KB

Download
memory/2632-1679-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2632-1682-0x000007FEF58D0000-0x000007FEF626D000-memory.dmp

Filesize
9.6MB

Download
memory/2632-1684-0x0000000001580000-0x0000000001600000-memory.dmp

Filesize
512KB

Download
memory/2632-1678-0x0000000019E80000-0x000000001A162000-memory.dmp

Filesize
2.9MB

Download
memory/2660-65-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-26-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/2688-1671-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2688-530-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/2688-54-0x00000000001D0000-0x0000000000224000-memory.dmp

Filesize
336KB

Download