Overview

overview

10

Static

static

3

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows10-2004-x64

10

75bff99bec...45.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:54

240417-r96wzada86 10

17-04-2024 14:54

240417-r95znsee4v 10

17-04-2024 14:54

240417-r943dada82 10

17-04-2024 14:54

240417-r9353sda77 10

17-04-2024 14:54

240417-r93jjsee3x 10

15-04-2024 13:19

240415-qkln3afc75 10

10-04-2024 12:02

240410-n7v5xaeh49 10

10-04-2024 12:02

240410-n7vjdaaa8t 10

Analysis

  • max time kernel
    1800s
  • max time network
    1801s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    17-04-2024 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75bff99becc32bcbe56efbe7a75f4d45.exe

  • Size

    7.0MB

  • MD5

    75bff99becc32bcbe56efbe7a75f4d45

  • SHA1

    81bfcc77809161a5254a27d3d4d30548c96fcd5b

  • SHA256

    8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2

  • SHA512

    940af628585713a16e685eb5251c0b954bc014460cd4ca33226df2ef260f32af56223eaf1c341862fdf1669c6bafb6e7d9c5efbeb5e437ce5e2fd9905beece69

  • SSDEEP

    49152:uW/1GYdVTXN3r3+LXDIDAKpvuh3jwLN6/VNUKIdI9OiKuDbD2yvAkdm5wrgWX+5z:hXkZL/p

Score
10/10
bitratzgratpersistencerattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80

Attributes
  • communication_password

    d93b4f1ee6f5b875a4f7fcef966bd09a

  • tor_process

    WinSock

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 44 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 47 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
    "C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:700
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2312
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4636
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4776
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3836
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2152
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3592
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2324
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4580
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1092
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1468
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2952
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4432
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2124
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2268
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4316
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1952
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2916
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:204
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4396
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:684
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4304
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2688
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4116
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4776
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:920
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2748
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:824
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4992
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:440
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2380
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1332
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3720
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1004
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4184
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2300
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:428
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1076
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3620
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3160
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1332
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1676
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4092
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:5000
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2028
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2716
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4672
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2936
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2248
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3008
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4292
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3944
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:164
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2196
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3904
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4596
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1804
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4564
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4752
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2440
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1144
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:208
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:556
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3472
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
          PID:2244
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
            PID:3624
          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
            3⤵
              PID:3880
            • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
              "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
              3⤵
                PID:2656
              • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                3⤵
                  PID:1760
                • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                  "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                  3⤵
                    PID:2988
                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                    "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                    3⤵
                      PID:4972
                    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                      "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                      3⤵
                        PID:3708
                      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                        3⤵
                          PID:2180
                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                          3⤵
                            PID:2736
                          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                            3⤵
                              PID:1980
                            • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                              "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                              3⤵
                                PID:3120
                              • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                3⤵
                                  PID:1280
                                • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                  "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                  3⤵
                                    PID:4904
                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                    "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                    3⤵
                                      PID:1508
                                    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                      "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                      3⤵
                                        PID:3752
                                      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                        3⤵
                                          PID:1772
                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                          3⤵
                                            PID:2020
                                          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                            3⤵
                                              PID:3484
                                            • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                              "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                              3⤵
                                                PID:4056
                                              • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                3⤵
                                                  PID:1124
                                                • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                  "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                  3⤵
                                                    PID:1588
                                                  • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                    "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                    3⤵
                                                      PID:2172
                                                    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                      "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                      3⤵
                                                        PID:1752
                                                      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                        3⤵
                                                          PID:976
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                          3⤵
                                                            PID:1928
                                                          • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                            "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
                                                            3⤵
                                                              PID:4152

                                                        Network

                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                        Initial Access

                                                        Execution

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Winlogon Helper DLL

                                                        1
                                                        T1547.004

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        1
                                                        T1547

                                                        Winlogon Helper DLL

                                                        1
                                                        T1547.004

                                                        Defense Evasion

                                                        Modify Registry

                                                        1
                                                        T1112

                                                        Credential Access

                                                        Discovery

                                                        System Information Discovery

                                                        1
                                                        T1082

                                                        Lateral Movement

                                                        Collection

                                                        Exfiltration

                                                        Command and Control

                                                        Impact

                                                        Resource Development

                                                        Reconnaissance

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
                                                          Filesize

                                                          973KB

                                                          MD5

                                                          5cfe61ff895c7daa889708665ef05d7b

                                                          SHA1

                                                          5e58efe30406243fbd58d4968b0492ddeef145f2

                                                          SHA256

                                                          f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

                                                          SHA512

                                                          43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
                                                          Filesize

                                                          20KB

                                                          MD5

                                                          13c7286f5e36a52113e686591a7a64de

                                                          SHA1

                                                          6e20f4aa60b4ce0b28b2be265f16450a341894a0

                                                          SHA256

                                                          ea8872dff50e3389d5dd32244a5d80b84b57a47372995d68d752a210b57a2ccd

                                                          SHA512

                                                          ad4e6145a57234c2687dc4dad684ceb7ffd69834086c3e1031ebc77ef49e9e25b3cbf3baf2b1292b397cb70a4aae6f2c0cf8bbbd4cd588033e2f1e2bea396672

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdesc-consensus.tmp
                                                          Filesize

                                                          2.6MB

                                                          MD5

                                                          824d601100461dff98727da8170c4db0

                                                          SHA1

                                                          b9734355b4ecc7021f0985dbb4c2227fe21bd882

                                                          SHA256

                                                          a212dc71ce3cb610fe044bbfe0301a48d464cea4dfba3b9e402a12cdc79a86d0

                                                          SHA512

                                                          0bc856b9671a4a858cca76ed8ed9b556ff237a04e2b4b0feac2fdfd7b72331d3fe822153a3d27c146ff73580b9a98e1d122a9e6bf9da0d69db6e3f5868599aec

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
                                                          Filesize

                                                          7.0MB

                                                          MD5

                                                          5bf53ea43c66ba36571f65c9c9f155c3

                                                          SHA1

                                                          7d3f729cd190ed7c3939caae29512d5ba8ced1ae

                                                          SHA256

                                                          79dd21c2ae5cce8ef5fc2f391ac5e31445cc8c8cd9adaae90daf496570d52b20

                                                          SHA512

                                                          4338fed8b4a3902c6c7b33d08cd5d78021fcf6a9f606f7f72da5ce123e852cb13bd5613ee844034b31df8a2a412f039a5591565fae67c323e2226ed74a279e25

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
                                                          Filesize

                                                          20.1MB

                                                          MD5

                                                          3de1dc219f314eaf97b4c0f3112f03f4

                                                          SHA1

                                                          33fc3e938bc31beb53d652e1efd8c89996c7dc32

                                                          SHA256

                                                          d52360a01f154c17fe0645ed16da656e411705ae6bb57b3d74e0aed43a356b33

                                                          SHA512

                                                          69870f605e75a50cd73622c6c7a0e1002193b9d3c8dac49532baa84fad18ca8f251f90eebf7647c3e382f60b42c6af4de2cc567e1900eccac99e44695a67ad8f

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
                                                          Filesize

                                                          232B

                                                          MD5

                                                          95ccd79bba28e90c9749f9c159278218

                                                          SHA1

                                                          8bbbf3a5963a6a013811c4fb7bf2a1890e690d29

                                                          SHA256

                                                          a888861dffea1a40d8d26447cb23ccdc9b54adda66f9fe35ac45b775bead50ea

                                                          SHA512

                                                          8e551e02a7dce4b7be07cddbdda8eb3074da462d348067d91c9ee635616b444bd81040c15f9dddb6017e6ccefa9e3734ef4a25e9ed804ffe2905b7fd4713cfeb

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libcrypto-1_1.dll
                                                          Filesize

                                                          1.7MB

                                                          MD5

                                                          2384a02c4a1f7ec481adde3a020607d3

                                                          SHA1

                                                          7e848d35a10bf9296c8fa41956a3daa777f86365

                                                          SHA256

                                                          c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

                                                          SHA512

                                                          1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libevent-2-1-6.dll
                                                          Filesize

                                                          366KB

                                                          MD5

                                                          099983c13bade9554a3c17484e5481f1

                                                          SHA1

                                                          a84e69ad9722f999252d59d0ed9a99901a60e564

                                                          SHA256

                                                          b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

                                                          SHA512

                                                          89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssp-0.dll
                                                          Filesize

                                                          88KB

                                                          MD5

                                                          2c916456f503075f746c6ea649cf9539

                                                          SHA1

                                                          fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

                                                          SHA256

                                                          cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

                                                          SHA512

                                                          1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

                                                          Download Submit
                                                        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\torrc
                                                          Filesize

                                                          157B

                                                          MD5

                                                          68afdef35a6105c2b148649bd05901b0

                                                          SHA1

                                                          828a2b590a95c2a411cc1b0004207747f2571024

                                                          SHA256

                                                          4e4e4e7f9fb03bcb898ce4f6075e3082d3a341d9fff1955ddf45089f83565622

                                                          SHA512

                                                          f198da05ec57c8525e6643f7f2c212701d0ab641d2850a28ce4cea7c33ac7b5c75782273bf7f01f95ccf02e27adf7c237ed116c5b0f220c13e70fe0aa7cfc671

                                                          Download Submit
                                                        • \Users\Admin\AppData\Local\d4f7be4f\tor\libgcc_s_sjlj-1.dll
                                                          Filesize

                                                          286KB

                                                          MD5

                                                          b0d98f7157d972190fe0759d4368d320

                                                          SHA1

                                                          5715a533621a2b642aad9616e603c6907d80efc4

                                                          SHA256

                                                          2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

                                                          SHA512

                                                          41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

                                                          Download Submit
                                                        • \Users\Admin\AppData\Local\d4f7be4f\tor\libssl-1_1.dll
                                                          Filesize

                                                          439KB

                                                          MD5

                                                          c88826ac4bb879622e43ead5bdb95aeb

                                                          SHA1

                                                          87d29853649a86f0463bfd9ad887b85eedc21723

                                                          SHA256

                                                          c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

                                                          SHA512

                                                          f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

                                                          Download Submit
                                                        • \Users\Admin\AppData\Local\d4f7be4f\tor\libwinpthread-1.dll
                                                          Filesize

                                                          188KB

                                                          MD5

                                                          d407cc6d79a08039a6f4b50539e560b8

                                                          SHA1

                                                          21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

                                                          SHA256

                                                          92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

                                                          SHA512

                                                          378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

                                                          Download Submit
                                                        • \Users\Admin\AppData\Local\d4f7be4f\tor\zlib1.dll
                                                          Filesize

                                                          52KB

                                                          MD5

                                                          add33041af894b67fe34e1dc819b7eb6

                                                          SHA1

                                                          6db46eb021855a587c95479422adcc774a272eeb

                                                          SHA256

                                                          8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

                                                          SHA512

                                                          bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

                                                          Download Submit
                                                        • memory/700-2474-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/700-2485-0x0000000001200000-0x0000000001288000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/700-2484-0x0000000072560000-0x00000000725E8000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/700-2483-0x0000000072700000-0x00000000729CF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/700-2482-0x0000000001C30000-0x0000000001EFF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/700-2481-0x00000000725F0000-0x00000000726FA000-memory.dmp
                                                          Filesize

                                                          1.0MB

                                                          Download
                                                        • memory/700-2479-0x0000000072AA0000-0x0000000072AE9000-memory.dmp
                                                          Filesize

                                                          292KB

                                                          Download
                                                        • memory/700-2480-0x00000000729D0000-0x0000000072A98000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/700-2476-0x0000000072AF0000-0x0000000072B14000-memory.dmp
                                                          Filesize

                                                          144KB

                                                          Download
                                                        • memory/700-2486-0x0000000072B20000-0x0000000072BEE000-memory.dmp
                                                          Filesize

                                                          824KB

                                                          Download
                                                        • memory/700-2547-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/700-2548-0x0000000001200000-0x0000000001288000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/700-2592-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/700-2595-0x0000000001200000-0x0000000001288000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/748-44-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-6-0x00000000731B0000-0x000000007389E000-memory.dmp
                                                          Filesize

                                                          6.9MB

                                                          Download
                                                        • memory/748-50-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-52-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-54-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-56-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-58-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-60-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-62-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-64-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-66-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-68-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-70-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-72-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-206-0x0000000002B80000-0x0000000002B90000-memory.dmp
                                                          Filesize

                                                          64KB

                                                          Download
                                                        • memory/748-1-0x0000000000060000-0x0000000000768000-memory.dmp
                                                          Filesize

                                                          7.0MB

                                                          Download
                                                        • memory/748-2442-0x00000000731B0000-0x000000007389E000-memory.dmp
                                                          Filesize

                                                          6.9MB

                                                          Download
                                                        • memory/748-2-0x00000000054E0000-0x00000000059DE000-memory.dmp
                                                          Filesize

                                                          5.0MB

                                                          Download
                                                        • memory/748-46-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-0-0x00000000731B0000-0x000000007389E000-memory.dmp
                                                          Filesize

                                                          6.9MB

                                                          Download
                                                        • memory/748-42-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-40-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-38-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-36-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-34-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-32-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-30-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-28-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-26-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-24-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-22-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-20-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-18-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-16-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-14-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-12-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-10-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-9-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-3-0x0000000004FE0000-0x0000000005072000-memory.dmp
                                                          Filesize

                                                          584KB

                                                          Download
                                                        • memory/748-8-0x0000000002A20000-0x0000000002AA2000-memory.dmp
                                                          Filesize

                                                          520KB

                                                          Download
                                                        • memory/748-4-0x0000000002B80000-0x0000000002B90000-memory.dmp
                                                          Filesize

                                                          64KB

                                                          Download
                                                        • memory/748-7-0x0000000007880000-0x0000000007DA0000-memory.dmp
                                                          Filesize

                                                          5.1MB

                                                          Download
                                                        • memory/748-48-0x0000000002A20000-0x0000000002A9C000-memory.dmp
                                                          Filesize

                                                          496KB

                                                          Download
                                                        • memory/748-5-0x0000000002B70000-0x0000000002B7A000-memory.dmp
                                                          Filesize

                                                          40KB

                                                          Download
                                                        • memory/2312-2600-0x0000000072B20000-0x0000000072BEE000-memory.dmp
                                                          Filesize

                                                          824KB

                                                          Download
                                                        • memory/2312-2579-0x0000000072B20000-0x0000000072BEE000-memory.dmp
                                                          Filesize

                                                          824KB

                                                          Download
                                                        • memory/2312-2580-0x0000000072AA0000-0x0000000072AE9000-memory.dmp
                                                          Filesize

                                                          292KB

                                                          Download
                                                        • memory/2312-2572-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/2312-2583-0x0000000072AF0000-0x0000000072B14000-memory.dmp
                                                          Filesize

                                                          144KB

                                                          Download
                                                        • memory/2312-2589-0x0000000072560000-0x00000000725E8000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/2312-2586-0x00000000725F0000-0x00000000726FA000-memory.dmp
                                                          Filesize

                                                          1.0MB

                                                          Download
                                                        • memory/2312-2574-0x0000000072700000-0x00000000729CF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/2312-2577-0x00000000729D0000-0x0000000072A98000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/2312-2597-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/2312-2598-0x0000000072700000-0x00000000729CF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/2312-2599-0x00000000729D0000-0x0000000072A98000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/4636-2623-0x0000000072560000-0x000000007262E000-memory.dmp
                                                          Filesize

                                                          824KB

                                                          Download
                                                        • memory/4636-2641-0x0000000072850000-0x0000000072918000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/4636-2614-0x0000000072800000-0x0000000072849000-memory.dmp
                                                          Filesize

                                                          292KB

                                                          Download
                                                        • memory/4636-2617-0x0000000072630000-0x00000000726B8000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/4636-2691-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/4636-2622-0x0000000072920000-0x0000000072BEF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/4636-2611-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/4636-2651-0x0000000072920000-0x0000000072BEF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/4636-2616-0x00000000726C0000-0x00000000727CA000-memory.dmp
                                                          Filesize

                                                          1.0MB

                                                          Download
                                                        • memory/4636-2615-0x00000000727D0000-0x00000000727F4000-memory.dmp
                                                          Filesize

                                                          144KB

                                                          Download
                                                        • memory/4636-2612-0x0000000072850000-0x0000000072918000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/4636-2650-0x0000000072800000-0x0000000072849000-memory.dmp
                                                          Filesize

                                                          292KB

                                                          Download
                                                        • memory/4636-2640-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/4776-2676-0x0000000072560000-0x000000007262E000-memory.dmp
                                                          Filesize

                                                          824KB

                                                          Download
                                                        • memory/4776-2679-0x0000000072800000-0x0000000072849000-memory.dmp
                                                          Filesize

                                                          292KB

                                                          Download
                                                        • memory/4776-2695-0x0000000072920000-0x0000000072BEF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/4776-2673-0x0000000072920000-0x0000000072BEF000-memory.dmp
                                                          Filesize

                                                          2.8MB

                                                          Download
                                                        • memory/4776-2671-0x0000000000990000-0x0000000000D94000-memory.dmp
                                                          Filesize

                                                          4.0MB

                                                          Download
                                                        • memory/4776-2675-0x0000000072850000-0x0000000072918000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/4776-2696-0x0000000072850000-0x0000000072918000-memory.dmp
                                                          Filesize

                                                          800KB

                                                          Download
                                                        • memory/4776-2685-0x00000000727D0000-0x00000000727F4000-memory.dmp
                                                          Filesize

                                                          144KB

                                                          Download
                                                        • memory/4776-2682-0x0000000072630000-0x00000000726B8000-memory.dmp
                                                          Filesize

                                                          544KB

                                                          Download
                                                        • memory/4776-2687-0x00000000726C0000-0x00000000727CA000-memory.dmp
                                                          Filesize

                                                          1.0MB

                                                          Download
                                                        • memory/5008-2441-0x0000000000400000-0x0000000000BD8000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/5008-2501-0x0000000072270000-0x00000000722AA000-memory.dmp
                                                          Filesize

                                                          232KB

                                                          Download
                                                        • memory/5008-2526-0x0000000000400000-0x0000000000BD8000-memory.dmp
                                                          Filesize

                                                          7.8MB

                                                          Download
                                                        • memory/5008-2444-0x00000000735A0000-0x00000000735DA000-memory.dmp
                                                          Filesize

                                                          232KB

                                                          Download