Resubmissions

11-04-2024 11:14

240411-nb5z8sdd7y 10

11-04-2024 11:14

240411-nb5dpsdd7w 10

11-04-2024 11:14

240411-nb43yaac56 10

11-04-2024 11:14

240411-nb3vwadd7t 10

11-04-2024 11:14

240411-nb3j4sac55 10

09-04-2024 03:54

240409-egc2zahd2z 10

09-04-2024 03:53

240409-ef443adg89 10

09-04-2024 03:53

240409-efxd8ahc9v 10

09-04-2024 03:53

240409-efmvsahc8w 10

03-04-2024 00:16

240403-akzypahh9t 10

Analysis

  • max time kernel
    1795s
  • max time network
    1805s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-04-2024 11:14

General

  • Target

    9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe

  • Size

    7.6MB

  • MD5

    9b035bad2b8a21fb2c57fd784c89b8d5

  • SHA1

    ee15fad65f3f22df7f54e218176c45d369ebb70f

  • SHA256

    2d49873798ab5ee10992f377ebb27ee940b1f354b9ec4ebebe687177ea2b214c

  • SHA512

    96c0189aba67db2f1c38affa5ac44665566ea17e20e5f749aef771739c81beb96bbcac8ea35aad80cffc9d492e23fcbaefbf03f72011d9bd1ccac36182466dde

  • SSDEEP

    196608:imEljesxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQUDxtw3iFFrS6XOfTV73cP:balxwZ6v1CPwDv3uFteg2EeJUO9WLjD/

Score
10/10

Malware Config

Extracted

Family

bitrat

Version

1.32

C2

7ix5nfolcp4ta4mk2dtihev73rw7d2edpbd5tp7sf7zgmpv66fpxnwqd.onion:80

Attributes
  • communication_password

    e10adc3949ba59abbe56e057f20f883e

  • tor_process

    dllhost

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT payload 2 IoCs
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Looks up external IP address via web service 42 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9b035bad2b8a21fb2c57fd784c89b8d5_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1392
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5044
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4956
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4472
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3928
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1048
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1196
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2224
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:484
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2812
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3464
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2712
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1392
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3000
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4616
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3788
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1992
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4144
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3784
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1876
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4612
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:748
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4520
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:784
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1488
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2260
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4208
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3248
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1096
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4612
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2144
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3824
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4400
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2996
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1288
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1324
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1640
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:652
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4944
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4484
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4124
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4040
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4500
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3768
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3268
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1688
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:692
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1392
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:392
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1052
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3804
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3384
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:380
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2256
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:3776
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:2100
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4180
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:4952
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:520
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:192
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:684
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
      • Executes dropped EXE
      PID:1288
    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
      2⤵
        PID:620
      • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
        "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
        2⤵
          PID:3480
        • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
          "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
          2⤵
            PID:4916
          • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
            "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
            2⤵
              PID:5076
            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
              "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
              2⤵
                PID:692
              • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                2⤵
                  PID:2064
                • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                  "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                  2⤵
                    PID:600
                  • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                    "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                    2⤵
                      PID:3000
                    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                      2⤵
                        PID:5016
                      • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                        "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                        2⤵
                          PID:212
                        • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                          "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                          2⤵
                            PID:948
                          • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                            "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                            2⤵
                              PID:2212
                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                              "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                              2⤵
                                PID:1876
                              • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                2⤵
                                  PID:3776
                                • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                  "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                  2⤵
                                    PID:1948
                                  • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                    "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                    2⤵
                                      PID:4784
                                    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                      2⤵
                                        PID:3548
                                      • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                        "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                        2⤵
                                          PID:2856
                                        • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                          "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                          2⤵
                                            PID:4540
                                          • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                            "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                            2⤵
                                              PID:1556
                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                              "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                              2⤵
                                                PID:3416
                                              • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                2⤵
                                                  PID:1712
                                                • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                  "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                  2⤵
                                                    PID:4916
                                                  • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                    "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                    2⤵
                                                      PID:664
                                                    • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                      "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                      2⤵
                                                        PID:2268
                                                      • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                        "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                        2⤵
                                                          PID:1536
                                                        • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                          "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                          2⤵
                                                            PID:2092
                                                          • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                            "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                            2⤵
                                                              PID:2608
                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe
                                                              "C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe" -f torrc
                                                              2⤵
                                                                PID:4692

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\cached-certs

                                                              Filesize

                                                              20KB

                                                              MD5

                                                              cce9fe3bb08950b42c179835effe875d

                                                              SHA1

                                                              b3f05f2e29197af8855e9cd04dea419b4dc0edb5

                                                              SHA256

                                                              90ad7c88e81f2d69eeadf0c2ee6d70e2311fc64562f6a1072d6e3f01cb7b7e4c

                                                              SHA512

                                                              a6dd27a7c82842ddcc0d64af5b06ca711d84717620e691b3d145f8c1afeb454fa8ef6cd0bde0315ed21700a81429a56738f2de6a61f2c0b62dcb5cadcac0559a

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\cached-microdesc-consensus.tmp

                                                              Filesize

                                                              2.7MB

                                                              MD5

                                                              a1ef6838f217c027c3abe2eb5891dc6c

                                                              SHA1

                                                              a93bdbe5e553e23e45378153fb86026a76741fd0

                                                              SHA256

                                                              43d67abc74bf54528d587ced07804275f3bc4d046f495d6bb931a101f0e99bd8

                                                              SHA512

                                                              e81782ea2293bc3e52320446b8b83a31bd82647bc470396bac8c54e9d58a7b79aa11c6cd48e8d0fa1fdc5144a5c6bcaa89b0b4daa905b3075ee2706fa0ed10b7

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\cached-microdescs

                                                              Filesize

                                                              20.3MB

                                                              MD5

                                                              acf0b43af5b6ac32eb1aff64cecd0023

                                                              SHA1

                                                              8b989d5982d6cc7eb9cfa5a2121f1635e2070c46

                                                              SHA256

                                                              9f98dff7e8ef764689d5f3eca057d1af9c207c5aba109c2d5509c10cd430ab5a

                                                              SHA512

                                                              3a7d56cd5f8ced58390fa6654f8d139a0c86ed569f3c75ec7fbd18bb276a3db9b55ddb1698132fc220dbf3b8291a13a2060196ef68147394a88f1e30574d554a

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\cached-microdescs.new

                                                              Filesize

                                                              20.3MB

                                                              MD5

                                                              574de5a30cf49e159da51cdd261c3a1b

                                                              SHA1

                                                              ee11c0de140bfeaf840521fc64df7d24782392d1

                                                              SHA256

                                                              caca5b000af233d9c24544a650acb854dd7c6afd3eba1b2314ae71d62b89a958

                                                              SHA512

                                                              e6c05dd7126f04f1dcc017dc41f23e9a09982e9a83cc10b121ccada385d715c6687c82876d4d4f0ff1a8b7b7b31eaf5745adb2fbabf13798683a1fd6fefffe8b

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\cached-microdescs.new

                                                              Filesize

                                                              7.7MB

                                                              MD5

                                                              5abd9fa9c72da051dc3715d02f46ccb9

                                                              SHA1

                                                              2c81c44c00d4d011813f3f24e77b997869fa43b1

                                                              SHA256

                                                              d0cd75f432982bacdb23a6eeef7345975ddc11382244f5a60124b77b64e42028

                                                              SHA512

                                                              3e7488ad250875fe84d98dc5d075a2569d27835040e869a350f03923c5509bf548658e3b6654f33f061a74f7916286f3ceaf13c0c6e7a19968fa43fb6dc4dcf0

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\state

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              6f68f734b25fe5a26b82dc086ff5b31b

                                                              SHA1

                                                              3850c805426bad9dfe92162b9e11911f4a383323

                                                              SHA256

                                                              2e77a2883f2c9f10cc4be14d92cdbab9252452b5c558c630daa816a40009764f

                                                              SHA512

                                                              3d5712848d571ad426bb25584114c82ca2206cd27f4ac981fb3460bfd7cb7a4bcf293df73a0400df4f40a66ed2d376bd54cd6db75f43387235cddc4ad7ed71c3

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\data\state

                                                              Filesize

                                                              9KB

                                                              MD5

                                                              211e375bf7416f6531f9748817c0dec5

                                                              SHA1

                                                              1e7195d76a1977986b3729879bed0426efa96843

                                                              SHA256

                                                              f51e1878664090007096164317710610dd62aba7a5bf13aff53be390ed46b531

                                                              SHA512

                                                              1d7647969f532be038f324b5923601dfe9958c786f78745d2b40d7ff4130e5fc96425fdda79c4ad1c8fd6b759f370c996b4726de337975c65f99de2609d8e1c5

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\dllhost.exe

                                                              Filesize

                                                              973KB

                                                              MD5

                                                              5cfe61ff895c7daa889708665ef05d7b

                                                              SHA1

                                                              5e58efe30406243fbd58d4968b0492ddeef145f2

                                                              SHA256

                                                              f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

                                                              SHA512

                                                              43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\libcrypto-1_1.dll

                                                              Filesize

                                                              1.7MB

                                                              MD5

                                                              2384a02c4a1f7ec481adde3a020607d3

                                                              SHA1

                                                              7e848d35a10bf9296c8fa41956a3daa777f86365

                                                              SHA256

                                                              c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

                                                              SHA512

                                                              1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\libevent-2-1-6.dll

                                                              Filesize

                                                              366KB

                                                              MD5

                                                              099983c13bade9554a3c17484e5481f1

                                                              SHA1

                                                              a84e69ad9722f999252d59d0ed9a99901a60e564

                                                              SHA256

                                                              b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

                                                              SHA512

                                                              89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

                                                            • C:\Users\Admin\AppData\Local\07fa2a3b\tor\torrc

                                                              Filesize

                                                              139B

                                                              MD5

                                                              dbd537e3da06f7d7aeaf58f4decc0c94

                                                              SHA1

                                                              7e740ea6dcf8545710f99519014e9bb029028a84

                                                              SHA256

                                                              349b36a467d778e29b96528cdd25d6c34a54be659a9ef516b3833106ceb679b2

                                                              SHA512

                                                              a84633c420c825b15ef2fc5cf83a6d75fcdddbb06d3b7dc74537d5bc98b5d910d3dec4838f30be3a06373662d2946f156f36bd2e033e0b6089753006ac327a90

                                                            • \Users\Admin\AppData\Local\07fa2a3b\tor\libgcc_s_sjlj-1.dll

                                                              Filesize

                                                              286KB

                                                              MD5

                                                              b0d98f7157d972190fe0759d4368d320

                                                              SHA1

                                                              5715a533621a2b642aad9616e603c6907d80efc4

                                                              SHA256

                                                              2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

                                                              SHA512

                                                              41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

                                                            • \Users\Admin\AppData\Local\07fa2a3b\tor\libssl-1_1.dll

                                                              Filesize

                                                              439KB

                                                              MD5

                                                              c88826ac4bb879622e43ead5bdb95aeb

                                                              SHA1

                                                              87d29853649a86f0463bfd9ad887b85eedc21723

                                                              SHA256

                                                              c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

                                                              SHA512

                                                              f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

                                                            • \Users\Admin\AppData\Local\07fa2a3b\tor\libssp-0.dll

                                                              Filesize

                                                              88KB

                                                              MD5

                                                              2c916456f503075f746c6ea649cf9539

                                                              SHA1

                                                              fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

                                                              SHA256

                                                              cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

                                                              SHA512

                                                              1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

                                                            • \Users\Admin\AppData\Local\07fa2a3b\tor\libwinpthread-1.dll

                                                              Filesize

                                                              188KB

                                                              MD5

                                                              d407cc6d79a08039a6f4b50539e560b8

                                                              SHA1

                                                              21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

                                                              SHA256

                                                              92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

                                                              SHA512

                                                              378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

                                                            • \Users\Admin\AppData\Local\07fa2a3b\tor\zlib1.dll

                                                              Filesize

                                                              52KB

                                                              MD5

                                                              add33041af894b67fe34e1dc819b7eb6

                                                              SHA1

                                                              6db46eb021855a587c95479422adcc774a272eeb

                                                              SHA256

                                                              8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

                                                              SHA512

                                                              bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

                                                            • memory/1048-321-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1048-323-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/1048-324-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/1048-327-0x0000000072980000-0x0000000072A4E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/1048-329-0x0000000073490000-0x00000000734D9000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/1048-331-0x0000000073460000-0x0000000073484000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/1392-84-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-35-0x00000000726D0000-0x000000007299F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/1392-55-0x0000000072A70000-0x0000000072B38000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/1392-57-0x00000000726D0000-0x000000007299F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/1392-58-0x00000000726A0000-0x00000000726C4000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/1392-56-0x00000000729A0000-0x0000000072A6E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/1392-53-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-74-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-17-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-88-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-99-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-26-0x0000000072B40000-0x0000000072B89000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/1392-108-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-116-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-127-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/1392-32-0x00000000726A0000-0x00000000726C4000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/1392-33-0x0000000072610000-0x0000000072698000-memory.dmp

                                                              Filesize

                                                              544KB

                                                            • memory/1392-34-0x00000000729A0000-0x0000000072A6E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/1392-28-0x0000000072A70000-0x0000000072B38000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/1392-54-0x0000000072B40000-0x0000000072B89000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/1392-36-0x0000000072500000-0x000000007260A000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/3136-40-0x0000000072230000-0x000000007226A000-memory.dmp

                                                              Filesize

                                                              232KB

                                                            • memory/3136-202-0x00000000726E0000-0x000000007271A000-memory.dmp

                                                              Filesize

                                                              232KB

                                                            • memory/3136-1-0x00000000734A0000-0x00000000734DA000-memory.dmp

                                                              Filesize

                                                              232KB

                                                            • memory/3136-0-0x0000000000400000-0x0000000000BAA000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/3136-107-0x0000000072DA0000-0x0000000072DDA000-memory.dmp

                                                              Filesize

                                                              232KB

                                                            • memory/3136-298-0x0000000071C40000-0x0000000071C7A000-memory.dmp

                                                              Filesize

                                                              232KB

                                                            • memory/3136-41-0x0000000000400000-0x0000000000BAA000-memory.dmp

                                                              Filesize

                                                              7.7MB

                                                            • memory/3928-333-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/3928-286-0x0000000072980000-0x0000000072A4E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/3928-283-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/3928-282-0x0000000072A50000-0x0000000072AD8000-memory.dmp

                                                              Filesize

                                                              544KB

                                                            • memory/3928-281-0x0000000072AE0000-0x0000000072BEA000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/3928-280-0x0000000073460000-0x0000000073484000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/3928-279-0x0000000073490000-0x00000000734D9000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/3928-299-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/3928-300-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/3928-309-0x0000000073490000-0x00000000734D9000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/3928-313-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/4472-260-0x0000000072A50000-0x0000000072AD8000-memory.dmp

                                                              Filesize

                                                              544KB

                                                            • memory/4472-265-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/4472-266-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/4472-245-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/4472-247-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/4472-267-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/4472-254-0x0000000073490000-0x00000000734D9000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/4472-256-0x0000000073460000-0x0000000073484000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/4472-252-0x0000000072980000-0x0000000072A4E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/4472-258-0x0000000072AE0000-0x0000000072BEA000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/4472-249-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/4956-179-0x0000000072A50000-0x0000000072AD8000-memory.dmp

                                                              Filesize

                                                              544KB

                                                            • memory/4956-174-0x0000000073490000-0x00000000734D9000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/4956-251-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/4956-213-0x0000000072980000-0x0000000072A4E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/4956-183-0x0000000072CC0000-0x0000000072F8F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/4956-180-0x0000000072980000-0x0000000072A4E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/4956-212-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/4956-171-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/4956-176-0x0000000072AE0000-0x0000000072BEA000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/4956-175-0x0000000073460000-0x0000000073484000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/4956-173-0x0000000072BF0000-0x0000000072CB8000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/4956-203-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/5044-156-0x00000000729A0000-0x0000000072A6E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/5044-150-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB

                                                            • memory/5044-153-0x00000000726D0000-0x000000007299F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/5044-155-0x0000000072A70000-0x0000000072B38000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/5044-154-0x0000000072610000-0x0000000072698000-memory.dmp

                                                              Filesize

                                                              544KB

                                                            • memory/5044-152-0x0000000072500000-0x000000007260A000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/5044-151-0x00000000726A0000-0x00000000726C4000-memory.dmp

                                                              Filesize

                                                              144KB

                                                            • memory/5044-149-0x0000000072B40000-0x0000000072B89000-memory.dmp

                                                              Filesize

                                                              292KB

                                                            • memory/5044-148-0x00000000729A0000-0x0000000072A6E000-memory.dmp

                                                              Filesize

                                                              824KB

                                                            • memory/5044-145-0x0000000072A70000-0x0000000072B38000-memory.dmp

                                                              Filesize

                                                              800KB

                                                            • memory/5044-143-0x00000000726D0000-0x000000007299F000-memory.dmp

                                                              Filesize

                                                              2.8MB

                                                            • memory/5044-141-0x0000000000050000-0x0000000000454000-memory.dmp

                                                              Filesize

                                                              4.0MB