Overview

overview

10

Static

static

3

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows10-2004-x64

10

75bff99bec...45.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:54

240417-r96wzada86 10

17-04-2024 14:54

240417-r95znsee4v 10

17-04-2024 14:54

240417-r943dada82 10

17-04-2024 14:54

240417-r9353sda77 10

17-04-2024 14:54

240417-r93jjsee3x 10

15-04-2024 13:19

240415-qkln3afc75 10

10-04-2024 12:02

240410-n7v5xaeh49 10

10-04-2024 12:02

240410-n7vjdaaa8t 10

Analysis

  • max time kernel
    1798s
  • max time network
    1806s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-04-2024 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75bff99becc32bcbe56efbe7a75f4d45.exe

  • Size

    7.0MB

  • MD5

    75bff99becc32bcbe56efbe7a75f4d45

  • SHA1

    81bfcc77809161a5254a27d3d4d30548c96fcd5b

  • SHA256

    8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2

  • SHA512

    940af628585713a16e685eb5251c0b954bc014460cd4ca33226df2ef260f32af56223eaf1c341862fdf1669c6bafb6e7d9c5efbeb5e437ce5e2fd9905beece69

  • SSDEEP

    49152:uW/1GYdVTXN3r3+LXDIDAKpvuh3jwLN6/VNUKIdI9OiKuDbD2yvAkdm5wrgWX+5z:hXkZL/p

Score
10/10
bitratzgratpersistencerattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80

Attributes
  • communication_password

    d93b4f1ee6f5b875a4f7fcef966bd09a

  • tor_process

    WinSock

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 50 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 38 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 41 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
    "C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:32
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4900
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4100
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1056
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2004
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3452
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4424
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:5100
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3760
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4960
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4852
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1800
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1400
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4452
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4192
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1396
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3304
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:592
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2816
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2136
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4544
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1400
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2704
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2700
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3740
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1048
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1928
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1176
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2536
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:196
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4220
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4520
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3304
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2296
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:60
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4536
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4040
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1456
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1908
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4976
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4052
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2804
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1792
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1060
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3184
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2080
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4268
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3476
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2140
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2216
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2976
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4176
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4964
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4792
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2068
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1932
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2700
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4944
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4840
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1752
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:68
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1576
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4824
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:876
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1456
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
          PID:404
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
            PID:1464
          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
            3⤵
              PID:3588
            • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
              "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
              3⤵
                PID:4856
              • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                3⤵
                  PID:2816
                • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                  "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                  3⤵
                    PID:2136
                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                    "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                    3⤵
                      PID:308
                    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                      "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                      3⤵
                        PID:1640
                      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                        3⤵
                          PID:1128
                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                          3⤵
                            PID:2748
                          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                            3⤵
                              PID:736
                            • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                              "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                              3⤵
                                PID:4884
                              • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                3⤵
                                  PID:3464
                                • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                  "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                  3⤵
                                    PID:3220
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                    "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                    3⤵
                                      PID:2688
                                    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                      "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                      3⤵
                                        PID:4956

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v13

                                  Initial Access

                                  Execution

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Winlogon Helper DLL

                                  1
                                  T1547.004

                                  Defense Evasion

                                  Modify Registry

                                  1
                                  T1112

                                  Credential Access

                                  Discovery

                                  System Information Discovery

                                  1
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Exfiltration

                                  Command and Control

                                  Impact

                                  Resource Development

                                  Reconnaissance

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                    Filesize

                                    973KB

                                    MD5

                                    5cfe61ff895c7daa889708665ef05d7b

                                    SHA1

                                    5e58efe30406243fbd58d4968b0492ddeef145f2

                                    SHA256

                                    f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

                                    SHA512

                                    43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
                                    Filesize

                                    13KB

                                    MD5

                                    71cf210dd77d7eb25d531657b76c5159

                                    SHA1

                                    f64f305931a99d5faf5436a2011d6f3946c2a191

                                    SHA256

                                    02a387634514858900394cf2a1885e6b163f95d035992362afa163bd2e94cc9e

                                    SHA512

                                    d70846ea01047b5a4257951acf90ba89c25de2a0d5189df12f1970bcfd69fd44a9636f65df22805ca2489990b000521f08ccc76d176c8a315cda70b5adbf9416

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdesc-consensus.tmp
                                    Filesize

                                    2.6MB

                                    MD5

                                    824d601100461dff98727da8170c4db0

                                    SHA1

                                    b9734355b4ecc7021f0985dbb4c2227fe21bd882

                                    SHA256

                                    a212dc71ce3cb610fe044bbfe0301a48d464cea4dfba3b9e402a12cdc79a86d0

                                    SHA512

                                    0bc856b9671a4a858cca76ed8ed9b556ff237a04e2b4b0feac2fdfd7b72331d3fe822153a3d27c146ff73580b9a98e1d122a9e6bf9da0d69db6e3f5868599aec

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
                                    Filesize

                                    6.6MB

                                    MD5

                                    2a5755c51ae153df60870aaf70c9558c

                                    SHA1

                                    4801ff0cd1c207a097b5767bd7d400cadbd9bf65

                                    SHA256

                                    172d213e9a2ca0233c244d76b0ca7a5eeab7bd81f50a14b327301bdf40eda1db

                                    SHA512

                                    c8e7b3f30c601e07f6c0fba9aa88c8329db347a6fb345eb6aabe31e35e491d5a905b844cd6b0e075d29ac69274e11b78b67465ef4ccc20eacaa653e924776126

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
                                    Filesize

                                    20.1MB

                                    MD5

                                    05c0a9370445db2e021e2b31cced9afa

                                    SHA1

                                    2573bddc00b0fcae9a5d6e2df9b7da5e8e511654

                                    SHA256

                                    c843ad5b0e429602d4b23894d204a71ca966c2db79df630b7d9d4d8cfa0a6403

                                    SHA512

                                    3e2292ad87209160393b246ed9c98ebc48571414b47e828b82047c75b06d6e42267532a466b028c1e5af891cd936a6f0c3d652825c0b138e1bd71cdafc5ebe8f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
                                    Filesize

                                    232B

                                    MD5

                                    a8639a8d8ce8b8f83144c79d4533c85f

                                    SHA1

                                    583261126a2f2971679f7c5fdc8ad33ae7a075a3

                                    SHA256

                                    70e3eb31c59d411bcdf6917bd21e9a313c264bbbac36383f501f6638d917301d

                                    SHA512

                                    ed80a38202ff58468feb5a9d8a1dcc82e5574607b56579965aeb1a0bbbebff85d8accb194bd57a9c80c8922ce369083517cfa4dd4fe5947dd8a5ae10d98bbb9b

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libgcc_s_sjlj-1.dll
                                    Filesize

                                    286KB

                                    MD5

                                    b0d98f7157d972190fe0759d4368d320

                                    SHA1

                                    5715a533621a2b642aad9616e603c6907d80efc4

                                    SHA256

                                    2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

                                    SHA512

                                    41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssp-0.dll
                                    Filesize

                                    88KB

                                    MD5

                                    2c916456f503075f746c6ea649cf9539

                                    SHA1

                                    fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

                                    SHA256

                                    cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

                                    SHA512

                                    1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\torrc
                                    Filesize

                                    157B

                                    MD5

                                    68afdef35a6105c2b148649bd05901b0

                                    SHA1

                                    828a2b590a95c2a411cc1b0004207747f2571024

                                    SHA256

                                    4e4e4e7f9fb03bcb898ce4f6075e3082d3a341d9fff1955ddf45089f83565622

                                    SHA512

                                    f198da05ec57c8525e6643f7f2c212701d0ab641d2850a28ce4cea7c33ac7b5c75782273bf7f01f95ccf02e27adf7c237ed116c5b0f220c13e70fe0aa7cfc671

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\zlib1.dll
                                    Filesize

                                    52KB

                                    MD5

                                    add33041af894b67fe34e1dc819b7eb6

                                    SHA1

                                    6db46eb021855a587c95479422adcc774a272eeb

                                    SHA256

                                    8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

                                    SHA512

                                    bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

                                    Download Submit
                                  • \Users\Admin\AppData\Local\d4f7be4f\tor\libcrypto-1_1.dll
                                    Filesize

                                    1.7MB

                                    MD5

                                    2384a02c4a1f7ec481adde3a020607d3

                                    SHA1

                                    7e848d35a10bf9296c8fa41956a3daa777f86365

                                    SHA256

                                    c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

                                    SHA512

                                    1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

                                    Download Submit
                                  • \Users\Admin\AppData\Local\d4f7be4f\tor\libevent-2-1-6.dll
                                    Filesize

                                    366KB

                                    MD5

                                    099983c13bade9554a3c17484e5481f1

                                    SHA1

                                    a84e69ad9722f999252d59d0ed9a99901a60e564

                                    SHA256

                                    b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

                                    SHA512

                                    89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

                                    Download Submit
                                  • \Users\Admin\AppData\Local\d4f7be4f\tor\libssl-1_1.dll
                                    Filesize

                                    439KB

                                    MD5

                                    c88826ac4bb879622e43ead5bdb95aeb

                                    SHA1

                                    87d29853649a86f0463bfd9ad887b85eedc21723

                                    SHA256

                                    c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

                                    SHA512

                                    f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

                                    Download Submit
                                  • \Users\Admin\AppData\Local\d4f7be4f\tor\libwinpthread-1.dll
                                    Filesize

                                    188KB

                                    MD5

                                    d407cc6d79a08039a6f4b50539e560b8

                                    SHA1

                                    21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

                                    SHA256

                                    92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

                                    SHA512

                                    378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

                                    Download Submit
                                  • memory/32-2637-0x0000000073310000-0x000000007334A000-memory.dmp
                                    Filesize

                                    232KB

                                    Download
                                  • memory/32-2503-0x0000000000400000-0x0000000000BD8000-memory.dmp
                                    Filesize

                                    7.8MB

                                    Download
                                  • memory/32-2440-0x0000000000400000-0x0000000000BD8000-memory.dmp
                                    Filesize

                                    7.8MB

                                    Download
                                  • memory/32-2560-0x00000000737E0000-0x000000007381A000-memory.dmp
                                    Filesize

                                    232KB

                                    Download
                                  • memory/32-2443-0x0000000073F10000-0x0000000073F4A000-memory.dmp
                                    Filesize

                                    232KB

                                    Download
                                  • memory/32-2494-0x0000000072C00000-0x0000000072C3A000-memory.dmp
                                    Filesize

                                    232KB

                                    Download
                                  • memory/1056-2657-0x0000000072660000-0x000000007276A000-memory.dmp
                                    Filesize

                                    1.0MB

                                    Download
                                  • memory/1056-2653-0x0000000072770000-0x0000000072838000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/1056-2651-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/1056-2656-0x0000000072EE0000-0x0000000072F04000-memory.dmp
                                    Filesize

                                    144KB

                                    Download
                                  • memory/1056-2658-0x00000000725D0000-0x0000000072658000-memory.dmp
                                    Filesize

                                    544KB

                                    Download
                                  • memory/1056-2659-0x0000000072F60000-0x000000007322F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/1056-2660-0x0000000072500000-0x00000000725CE000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/1056-2690-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/1056-2691-0x0000000072770000-0x0000000072838000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/1056-2692-0x0000000072F60000-0x000000007322F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/1056-2693-0x0000000072500000-0x00000000725CE000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/1056-2655-0x0000000072F10000-0x0000000072F59000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/1564-44-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-30-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-58-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-60-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-62-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-64-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-66-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-68-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-70-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-72-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-2441-0x0000000073B20000-0x000000007420E000-memory.dmp
                                    Filesize

                                    6.9MB

                                    Download
                                  • memory/1564-54-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-52-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-50-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-22-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-48-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-20-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-46-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-0-0x0000000073B20000-0x000000007420E000-memory.dmp
                                    Filesize

                                    6.9MB

                                    Download
                                  • memory/1564-42-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-40-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-38-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-36-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-24-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-26-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-1-0x0000000000270000-0x0000000000978000-memory.dmp
                                    Filesize

                                    7.0MB

                                    Download
                                  • memory/1564-34-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-2-0x0000000005800000-0x0000000005CFE000-memory.dmp
                                    Filesize

                                    5.0MB

                                    Download
                                  • memory/1564-3-0x00000000053A0000-0x0000000005432000-memory.dmp
                                    Filesize

                                    584KB

                                    Download
                                  • memory/1564-4-0x0000000005620000-0x0000000005630000-memory.dmp
                                    Filesize

                                    64KB

                                    Download
                                  • memory/1564-5-0x0000000005320000-0x000000000532A000-memory.dmp
                                    Filesize

                                    40KB

                                    Download
                                  • memory/1564-6-0x0000000073B20000-0x000000007420E000-memory.dmp
                                    Filesize

                                    6.9MB

                                    Download
                                  • memory/1564-7-0x0000000007CC0000-0x00000000081E0000-memory.dmp
                                    Filesize

                                    5.1MB

                                    Download
                                  • memory/1564-32-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-56-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-8-0x0000000004D50000-0x0000000004DD2000-memory.dmp
                                    Filesize

                                    520KB

                                    Download
                                  • memory/1564-9-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-10-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-12-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-14-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-16-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-18-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/1564-28-0x0000000004D50000-0x0000000004DCC000-memory.dmp
                                    Filesize

                                    496KB

                                    Download
                                  • memory/2004-2717-0x0000000072F10000-0x0000000072F59000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/2004-2715-0x0000000072500000-0x00000000725CE000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/2004-2716-0x0000000072F60000-0x000000007322F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/2004-2718-0x0000000072EE0000-0x0000000072F04000-memory.dmp
                                    Filesize

                                    144KB

                                    Download
                                  • memory/4100-2636-0x0000000073070000-0x00000000730B9000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4100-2610-0x0000000073260000-0x000000007352F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/4100-2617-0x0000000073070000-0x00000000730B9000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4100-2619-0x0000000073FB0000-0x0000000073FD4000-memory.dmp
                                    Filesize

                                    144KB

                                    Download
                                  • memory/4100-2615-0x0000000073190000-0x000000007325E000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/4100-2622-0x0000000072ED0000-0x0000000072FDA000-memory.dmp
                                    Filesize

                                    1.0MB

                                    Download
                                  • memory/4100-2625-0x0000000072FE0000-0x0000000073068000-memory.dmp
                                    Filesize

                                    544KB

                                    Download
                                  • memory/4100-2633-0x0000000073260000-0x000000007352F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/4100-2634-0x00000000730C0000-0x0000000073188000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/4100-2635-0x0000000073190000-0x000000007325E000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/4100-2608-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/4100-2632-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/4100-2612-0x00000000730C0000-0x0000000073188000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/4900-2518-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2486-0x0000000072FE0000-0x0000000073068000-memory.dmp
                                    Filesize

                                    544KB

                                    Download
                                  • memory/4900-2623-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/4900-2516-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2515-0x00000000730C0000-0x0000000073188000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/4900-2514-0x0000000073190000-0x000000007325E000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/4900-2513-0x0000000073260000-0x000000007352F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/4900-2504-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download
                                  • memory/4900-2487-0x0000000072ED0000-0x0000000072FDA000-memory.dmp
                                    Filesize

                                    1.0MB

                                    Download
                                  • memory/4900-2517-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2485-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2484-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2483-0x0000000001FC0000-0x0000000002009000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2481-0x0000000073070000-0x00000000730B9000-memory.dmp
                                    Filesize

                                    292KB

                                    Download
                                  • memory/4900-2478-0x00000000730C0000-0x0000000073188000-memory.dmp
                                    Filesize

                                    800KB

                                    Download
                                  • memory/4900-2476-0x0000000073FB0000-0x0000000073FD4000-memory.dmp
                                    Filesize

                                    144KB

                                    Download
                                  • memory/4900-2477-0x0000000073190000-0x000000007325E000-memory.dmp
                                    Filesize

                                    824KB

                                    Download
                                  • memory/4900-2464-0x0000000073260000-0x000000007352F000-memory.dmp
                                    Filesize

                                    2.8MB

                                    Download
                                  • memory/4900-2458-0x0000000000E00000-0x0000000001204000-memory.dmp
                                    Filesize

                                    4.0MB

                                    Download