growtopia | 5a52085a5f8f591347e11bc4c9246887ebe5dcde0209edc7016e3d6000f1defa

Resubmissions

06-02-2024 13:38

240206-qxtv7sgcc7 10

06-02-2024 13:35

240206-qv2g9sgbg2 3

Analysis

max time kernel
149s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-02-2024 13:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BlitzWare_Fortnite_Menu/BlitzWare.exe
Size

12.8MB
MD5

3b4a760c064fa2e6f5b05c9da03333c6
SHA1

8053af5d5858430a3b6f28ad3c8c5be47932dd5d
SHA256

bc2d16deb9222945b10f9511c777d7125042d31d748a0f42affc8a659f2dac79
SHA512

54399f1198a15e52d04d0d8a0f59ccfeec067ccf331393a1311bb81b6f034449c42ec02fe3811f827847b93916a2264408035c49946e598368bb9a9278cdba0a
SSDEEP

196608:Ob5hSxqJAcXCMEKngteZX07mvbSHL8D++wsmReLZijeBCMcwJADXbsdMN2LId+3B:Obmq7yMERtD2bysmMijstOX422cdK

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2640-53-0x00000000002D0000-0x000000000033C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-58-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-65-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-76-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-81-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-90-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-94-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-108-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-116-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-118-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-114-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-112-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-110-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-106-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-136-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-134-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-132-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-130-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-128-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-126-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-104-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-102-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-100-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-98-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-96-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-92-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-88-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-85-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-83-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-79-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-71-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-63-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-61-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1
behavioral1/memory/2640-59-0x00000000002D0000-0x0000000000335000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeKeyGeneratorI.exeSahyui1337.exeKeyGeneratorI.exeWinErrorMgr.exebauwrdgwodhv.exe

pid	process
2640	Ilkdt.exe
2364	WinHostMgr.exe
2448	WinErrorMgr.exe
2552	KeyGeneratorI.exe
2136	Sahyui1337.exe
1232	KeyGeneratorI.exe
1780	WinErrorMgr.exe
480
1816	bauwrdgwodhv.exe

Loads dropped DLL 9 IoCs

Processes:

BlitzWare.exeWinErrorMgr.exeKeyGeneratorI.exe

pid	process
1236	BlitzWare.exe
1236	BlitzWare.exe
1236	BlitzWare.exe
1236	BlitzWare.exe
1236	BlitzWare.exe
1236	BlitzWare.exe
2448	WinErrorMgr.exe
1232	KeyGeneratorI.exe
480

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

2 discord.com
3 discord.com
11 pastebin.com
12 pastebin.com

flow	ioc
2	discord.com
3	discord.com
11	pastebin.com
12	pastebin.com

Drops file in System32 directory 3 IoCs

Processes:

WinHostMgr.exepowershell.exebauwrdgwodhv.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 1816 set thread context of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 set thread context of 2492	1816	bauwrdgwodhv.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

wusa.exewusa.exe

description ioc process

File created C:\Windows\wusa.lock wusa.exe
File created C:\Windows\wusa.lock wusa.exe
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1640 sc.exe
3044 sc.exe
2232 sc.exe
848 sc.exe
2340 sc.exe
2188 sc.exe
2144 sc.exe
2968 sc.exe
1960 sc.exe
488 sc.exe
1344 sc.exe
1500 sc.exe
1132 sc.exe
2924 sc.exe

description	ioc	process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

pid	process
1640	sc.exe
3044	sc.exe
2232	sc.exe
848	sc.exe
2340	sc.exe
2188	sc.exe
2144	sc.exe
2968	sc.exe
1960	sc.exe
488	sc.exe
1344	sc.exe
1500	sc.exe
1132	sc.exe
2924	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1372 schtasks.exe

pid	process
1372	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

explorer.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 30c83d100259da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sahyui1337.exepowershell.exeWinHostMgr.exebauwrdgwodhv.exepowershell.exeexplorer.exe

pid	process
2136	Sahyui1337.exe
2136	Sahyui1337.exe
2516	powershell.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
2364	WinHostMgr.exe
1816	bauwrdgwodhv.exe
1972	powershell.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
1816	bauwrdgwodhv.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe
2492	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

Ilkdt.exeSahyui1337.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2640	Ilkdt.exe
Token: SeDebugPrivilege	2136	Sahyui1337.exe
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeShutdownPrivilege	2180	powercfg.exe
Token: SeShutdownPrivilege	1724	powercfg.exe
Token: SeShutdownPrivilege	964	powercfg.exe
Token: SeShutdownPrivilege	3068	powercfg.exe
Token: SeDebugPrivilege	1972	powershell.exe
Token: SeShutdownPrivilege	2312	powercfg.exe
Token: SeShutdownPrivilege	1628	powercfg.exe
Token: SeShutdownPrivilege	892	powercfg.exe
Token: SeShutdownPrivilege	1576	powercfg.exe
Token: SeLockMemoryPrivilege	2492	explorer.exe

Suspicious use of WriteProcessMemory 55 IoCs

Processes:

BlitzWare.exeKeyGeneratorI.exeWinErrorMgr.exeWinErrorMgr.execmd.execmd.exebauwrdgwodhv.exe

description	pid	process	target process
PID 1236 wrote to memory of 2516	1236	BlitzWare.exe	powershell.exe
PID 1236 wrote to memory of 2516	1236	BlitzWare.exe	powershell.exe
PID 1236 wrote to memory of 2516	1236	BlitzWare.exe	powershell.exe
PID 1236 wrote to memory of 2516	1236	BlitzWare.exe	powershell.exe
PID 1236 wrote to memory of 2640	1236	BlitzWare.exe	Ilkdt.exe
PID 1236 wrote to memory of 2640	1236	BlitzWare.exe	Ilkdt.exe
PID 1236 wrote to memory of 2640	1236	BlitzWare.exe	Ilkdt.exe
PID 1236 wrote to memory of 2640	1236	BlitzWare.exe	Ilkdt.exe
PID 1236 wrote to memory of 2364	1236	BlitzWare.exe	WinHostMgr.exe
PID 1236 wrote to memory of 2364	1236	BlitzWare.exe	WinHostMgr.exe
PID 1236 wrote to memory of 2364	1236	BlitzWare.exe	WinHostMgr.exe
PID 1236 wrote to memory of 2364	1236	BlitzWare.exe	WinHostMgr.exe
PID 1236 wrote to memory of 2448	1236	BlitzWare.exe	WinErrorMgr.exe
PID 1236 wrote to memory of 2448	1236	BlitzWare.exe	WinErrorMgr.exe
PID 1236 wrote to memory of 2448	1236	BlitzWare.exe	WinErrorMgr.exe
PID 1236 wrote to memory of 2448	1236	BlitzWare.exe	WinErrorMgr.exe
PID 1236 wrote to memory of 2552	1236	BlitzWare.exe	KeyGeneratorI.exe
PID 1236 wrote to memory of 2552	1236	BlitzWare.exe	KeyGeneratorI.exe
PID 1236 wrote to memory of 2552	1236	BlitzWare.exe	KeyGeneratorI.exe
PID 1236 wrote to memory of 2552	1236	BlitzWare.exe	KeyGeneratorI.exe
PID 1236 wrote to memory of 2136	1236	BlitzWare.exe	Sahyui1337.exe
PID 1236 wrote to memory of 2136	1236	BlitzWare.exe	Sahyui1337.exe
PID 1236 wrote to memory of 2136	1236	BlitzWare.exe	Sahyui1337.exe
PID 1236 wrote to memory of 2136	1236	BlitzWare.exe	Sahyui1337.exe
PID 2552 wrote to memory of 1232	2552	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2552 wrote to memory of 1232	2552	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2552 wrote to memory of 1232	2552	KeyGeneratorI.exe	KeyGeneratorI.exe
PID 2448 wrote to memory of 1780	2448	WinErrorMgr.exe	WinErrorMgr.exe
PID 2448 wrote to memory of 1780	2448	WinErrorMgr.exe	WinErrorMgr.exe
PID 2448 wrote to memory of 1780	2448	WinErrorMgr.exe	WinErrorMgr.exe
PID 2448 wrote to memory of 1780	2448	WinErrorMgr.exe	WinErrorMgr.exe
PID 1780 wrote to memory of 1372	1780	WinErrorMgr.exe	schtasks.exe
PID 1780 wrote to memory of 1372	1780	WinErrorMgr.exe	schtasks.exe
PID 1780 wrote to memory of 1372	1780	WinErrorMgr.exe	schtasks.exe
PID 1780 wrote to memory of 1372	1780	WinErrorMgr.exe	schtasks.exe
PID 2212 wrote to memory of 1268	2212	cmd.exe	wusa.exe
PID 2212 wrote to memory of 1268	2212	cmd.exe	wusa.exe
PID 2212 wrote to memory of 1268	2212	cmd.exe	wusa.exe
PID 712 wrote to memory of 2576	712	cmd.exe	wusa.exe
PID 712 wrote to memory of 2576	712	cmd.exe	wusa.exe
PID 712 wrote to memory of 2576	712	cmd.exe	wusa.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 1452	1816	bauwrdgwodhv.exe	conhost.exe
PID 1816 wrote to memory of 2492	1816	bauwrdgwodhv.exe	explorer.exe
PID 1816 wrote to memory of 2492	1816	bauwrdgwodhv.exe	explorer.exe
PID 1816 wrote to memory of 2492	1816	bauwrdgwodhv.exe	explorer.exe
PID 1816 wrote to memory of 2492	1816	bauwrdgwodhv.exe	explorer.exe
PID 1816 wrote to memory of 2492	1816	bauwrdgwodhv.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe
"C:\Users\Admin\AppData\Local\Temp\BlitzWare_Fortnite_Menu\BlitzWare.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHYAbABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAdwB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAaQBjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:1268
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2144
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2232
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:488
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1640
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:848
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1344
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2340
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2188
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1500
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAAEF.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1372
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1232
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1452
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:892
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2968
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1132
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:712

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
- Drops file in Windows directory
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.1MB

MD5
2afe0895be6d2cab613f2df31465c9e5

SHA1
8f0c2262aef50db81f2818a9014e955a31f15f04

SHA256
ebe53393034b71e52d70b5ca4d160fc823795d7c66f8f3bbb9f6e943bd970912

SHA512
8aae891be9aa7aaa0b5e5b3b35105e6dcc1ee59fd09bb12630491635b20ef63f90a6f7b84e3adc3c1cb1e6f629e30ea5efd3fd3c5cdcb6fee21b7a01a68fbb78

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.7MB

MD5
6cb4c14533db5d44d44aa6eda3e6581c

SHA1
9b2c005d74feb199fb93d2ab54d42aea7763d074

SHA256
ee6c259ee796fbda3fba160f1630647c95e55671d22777a065fc41f91e065288

SHA512
de4567d16c2b446373fad69925bd562f5138c3a962cfde2849406520ee3d0fdc50c3fb84b1daafa408ddd3ee6fbbf65cc19ff5df403b8ce1197410e27c3be867

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
189KB

MD5
825e60785b1235b677ad630c3db56037

SHA1
7942e00d4086fb6c71fec6f54e316b35dbe9c5de

SHA256
8167f10b5fb20d919b71310c8ad42e3ea4047cdd27e8c9d7734a13a3a9a3c535

SHA512
6f97b7e82dc1aebe27a0e020320e34e7401d79253840c73688effc1dff1d407c4d0fbdb237cd95cda5776f258a3acbc37360b1172bea6a43e2ffa53fc94f7d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
198KB

MD5
8932c0437450e8a36a16f6fd0b7680ad

SHA1
e1b12284046862b5d02559b3b7822acb6e74d0be

SHA256
1fb28bd7d051f51f47f4513c0022f3e5683cbab0b1f4e622a2c2a2f6e1e87fcc

SHA512
902ec4456bc526b9d24dac73c931c14dc99f68a282b938d6072e51b3240fb41c374a09d3e221b1e18eef165d13942dce8daaa5e2fcd111579a92705b92ed373a

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
606KB

MD5
9ed6da336d29b914dd1e9feb44c35952

SHA1
d261ad29486300d5e0b0a179ebcd43ffb3f2f6b6

SHA256
bc2cb4319d9af68e0b859cd81265cf9b49e4ffe6a5eaf3ad1ff16f3a563c5a36

SHA512
eccbcb924b39c12a93997c19c0086183f7397eceae95a650109d0a25fe35d972ab9234865e98c6471116cf10d49c4f3154d11b1a15db7e3cfbce7e40eb641a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
520KB

MD5
173267e0458b33faf2d7a1d62835e59b

SHA1
edd95cc6b228e52b9d0869e959ed9495546f137b

SHA256
dbfa2f438d10ea0f71810ef4af290c46f1b496440a295a7ade49f8ae57a4d865

SHA512
37ba3b1e4d8fa4a25f8bd38b31515764931ebe444b94ce4126e95176088d406059d019f1a454b44cdd8fb576e72743b8999638ad5ed06f94526cb42ea00368a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.4MB

MD5
c2d5109b588e7f5b9c518e37c2842419

SHA1
872915e447ae161dae3118c42614ba76c15fab9a

SHA256
d442099f5b520ec4795d35f514c884c086ffdac4423d869fb888a38816656864

SHA512
c30ecfeb5ebb2e1f753c8760b5f66aca2af879678225579fc63071619baf8f78564d6a03b52fd1ebbe3cfdc8e97a814b79463a9d0b67ed56623db2d576701f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25522\python312.dll

Filesize
329KB

MD5
8a27a894e8ccc59b598efc7aaa96b60e

SHA1
10e86da25f9c85f784064d1f0128eb9013962683

SHA256
b21a9c7b42142258ab249db66edf9cc71bd210b24c0025681747dd8bedf31cd5

SHA512
fbe93e9bb0e2e779bb6c6e37858ff744aa814404f16f7b5f9eac3c9153a4033825628b28546df80b6c3c91cff5faa1b0a25e7be1b25638a3273090ee556fdde0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAAEF.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
236KB

MD5
6ce239821e849c578b9203cfef454c51

SHA1
26b47b9f250d36c7803b4670fdb07abaa6232812

SHA256
648dd2d8375085b588c55fb8ad4c99ef0b70e38354b0c19d584a465555591481

SHA512
ac38a2b01f0123702a20452d6a1b14b2be5931a03d76586c2755b670278fa7c248e45cb04afbcefb6e24bc24e1837c02f18a6f45a6188dba3c9252d9d323c320

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
280KB

MD5
72d1de55922c58a9ce4308386f57f72b

SHA1
5b50bd023e42dfbc0744421346dbc105803bb840

SHA256
b4fba0055efa9f2878b8a73aa614c595d2c7eb54821469cbfbd5f8ea7c7a1dcd

SHA512
248a91331254c044b36c3815ee69e75136fe58af924c294a2c9d771201eee13545437de1b29de530c0230d6657256da155c482fb0dcf41fa7af5cf4a720779cc

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
313KB

MD5
c7b29edfb21b553ca4b6e9e3fff17e51

SHA1
e5af79542ce2a6a6c6174ef13c2122ab2137e428

SHA256
e19194815a66c1b42bc7bc385dfa40742b604de6303b6ca44c0eb0cbbd4cee82

SHA512
f7ff567ccd97c68f8dd9a1eedcc43cff50f5516fefc236a1ce05155d6a372e20a8c08bce66d55245260480c657c25f218ce5f8d04484bb0851b2f181338d6dc7

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.4MB

MD5
57ad0dfa53a84d1b62f193954abace97

SHA1
dee6282a16804606b079f0e646037132eab3742d

SHA256
c67bebb10c416938429e2688aba37ad2e3a6a75d4a261b7b4aa9f3af89fb0861

SHA512
fc27ca02af60b37b1b3dae05971c7d22937ead17743bd5c9e81ea5b392be570d273610a13fad43e37af99593c6a6da4df694146e819fc9224ce21c4d154b6d26

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.3MB

MD5
1568403fc7997af883f7bb8d4b42592f

SHA1
ddf51bb6b6f63bd49181a99db3be2ca86b995f5e

SHA256
afb8cdd112768b68f790a772c08552479b5126ce7df1c691d7b385701e5001f0

SHA512
27f126522d1ffffdd53f56ce1c48396ad65b18d5316cc7f041d11fe55914d1a2d5b69b28129d388140c8cf5350e086b5d7973d09f9204005afb270c844dafa19

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
249KB

MD5
d793640881da549fc348289f8cf6161a

SHA1
be6389332f390f9a6ee38f6e10235271c57812a7

SHA256
d984774270c5f42cc996a2c9c231ff2ab936ba1e313545dd963a573b7540cada

SHA512
1759cb9c19597bb49356bb6d4cebc027cf5d2aadd733bade1db92064e0aa4044d5cff5720b79fd2203815994c5baf6182bb7cb4f42ab99f721ffc642083c2ef9

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
591KB

MD5
1b243c85bfba7f964e5b6b30c12cf81b

SHA1
b3cbe9d0bb91b5a814e8290ca21bf5c924a77593

SHA256
1a8f3801c8e763aca728ca332fd48fd970ed4bb6bb7953ddd6b06f6ca45812be

SHA512
93e404cbcc82036a83b943f6b9d470256a5a91424761fb8440b740a8d8f5a218d4eb3ca1fccca67818d879dcc05638927bb96b08e8217f5cdbff6566e0dc166e

Download Submit
\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
706KB

MD5
bf217fa91fcb11cc4788829fd02d01c5

SHA1
296067167a702473b84a6249e48d97591efe9da0

SHA256
ca310c5c5c120db9d481426f546ab6089d4b2672abdb6a7b6b66f3241aca170c

SHA512
3ced28145501ff326b48d9828239498df8657250c7c15eae3129e337e90716066a5e42934779a5b6da4229181e330b90ff809620c3cc12bbf782cf476735246a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI25522\python312.dll

Filesize
175KB

MD5
11205e06b09d5958612630f9c29ee923

SHA1
f1008a352d50beee76398fda9d75b2d8295e5897

SHA256
fb8b31e82ed322e7e79b7f86391b65ebd1454cf260e6f7818a23cc70dd69e712

SHA512
bfc998402739689fa04d6fd2c6c6aa861ee8ec7459e751d92fa44b6280cf772dd543fd489528723bc3ad6e9e5970b5dfaf7b23e27e011ff332a9d71a4ad08773

Download Submit
\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
205KB

MD5
f7186e2fcc67d1b96e882037341f49a5

SHA1
f63dbc5bb664295a785c64002cf7d8dacf856373

SHA256
958528b91857c38f904c86978c28c28f40854b7a732c3c30968b903a125a4288

SHA512
36bd5c671d33e32cae3cb22408256cec1d8b45b4791b0e5cd3e8d86aa2bb8e4ee2bed5b957bcf4bcf885ae13cf72c3b1ea2279ac230b920b02a1a54009153980

Download Submit
memory/1780-125-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/1780-75-0x00000000013B0000-0x00000000013C0000-memory.dmp

Filesize
64KB

Download
memory/1780-1679-0x0000000000E70000-0x0000000000EB0000-memory.dmp

Filesize
256KB

Download
memory/1780-1680-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/1780-1681-0x0000000000E70000-0x0000000000EB0000-memory.dmp

Filesize
256KB

Download
memory/1972-1690-0x0000000001400000-0x0000000001480000-memory.dmp

Filesize
512KB

Download
memory/1972-1694-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/1972-1692-0x0000000001400000-0x0000000001480000-memory.dmp

Filesize
512KB

Download
memory/1972-1688-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/1972-1687-0x0000000019FC0000-0x000000001A2A2000-memory.dmp

Filesize
2.9MB

Download
memory/1972-1693-0x0000000001400000-0x0000000001480000-memory.dmp

Filesize
512KB

Download
memory/1972-1691-0x000007FEF5050000-0x000007FEF59ED000-memory.dmp

Filesize
9.6MB

Download
memory/1972-1689-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/2136-50-0x0000000000980000-0x00000000009D4000-memory.dmp

Filesize
336KB

Download
memory/2136-122-0x000007FEF4FA0000-0x000007FEF598C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-120-0x000007FEF4FA0000-0x000007FEF598C000-memory.dmp

Filesize
9.9MB

Download
memory/2448-31-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/2448-78-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2492-1719-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/2492-1720-0x00000000002C0000-0x00000000002E0000-memory.dmp

Filesize
128KB

Download
memory/2516-124-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2516-218-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/2516-121-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2516-56-0x0000000002D40000-0x0000000002D80000-memory.dmp

Filesize
256KB

Download
memory/2516-55-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/2516-57-0x0000000073140000-0x00000000736EB000-memory.dmp

Filesize
5.7MB

Download
memory/2640-58-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-102-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-104-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-100-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-98-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-96-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-92-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-88-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-85-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-83-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-126-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-79-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-71-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-63-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-61-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-59-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-128-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-130-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-1666-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-132-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-134-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-136-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-106-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-123-0x0000000004AC0000-0x0000000004B00000-memory.dmp

Filesize
256KB

Download
memory/2640-110-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-112-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-114-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-118-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-116-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-108-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-94-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-90-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-81-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-76-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-65-0x00000000002D0000-0x0000000000335000-memory.dmp

Filesize
404KB

Download
memory/2640-53-0x00000000002D0000-0x000000000033C000-memory.dmp

Filesize
432KB

Download
memory/2640-52-0x0000000073FC0000-0x00000000746AE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-29-0x0000000000120000-0x0000000000156000-memory.dmp

Filesize
216KB

Download