Resubmissions
09-04-2024 13:50
240409-q5ca5abh9y 1009-04-2024 13:50
240409-q5bplagf55 1009-04-2024 13:50
240409-q5a33abh9v 1009-04-2024 13:50
240409-q5asasgf53 1028-08-2023 01:46
230828-b68cmaef44 10Analysis
-
max time kernel
1200s -
max time network
1206s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 13:50
Behavioral task
behavioral1
Sample
d151ec74b0a409363d9401eeb348efaa.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d151ec74b0a409363d9401eeb348efaa.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
d151ec74b0a409363d9401eeb348efaa.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
d151ec74b0a409363d9401eeb348efaa.exe
Resource
win11-20240319-en
General
-
Target
d151ec74b0a409363d9401eeb348efaa.exe
-
Size
7.8MB
-
MD5
d151ec74b0a409363d9401eeb348efaa
-
SHA1
36aefe3ff9c3f0d0318288259b2b7473855972fd
-
SHA256
def365ca4816c8d33a32a6ccf7632a875c77672c2c148d6720e8b26f66e5eec6
-
SHA512
053d850ef72a40d11735f927bf17f6df542eba622895c3a61c9294d79037c67330dfe7a6b81ec50e3a2bd8612504bdbf81161aae7925be8e2612c752725022ec
-
SSDEEP
196608:LIRcbH4jSteTGvzxwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:LdHsfuzxwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\795e6f10\tor\libcrypto-1_1.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\libevent-2-1-6.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\libssp-0.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\libssl-1_1.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\libwinpthread-1.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\zlib1.dll acprotect C:\Users\Admin\AppData\Local\795e6f10\tor\libgcc_s_sjlj-1.dll acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d151ec74b0a409363d9401eeb348efaa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation d151ec74b0a409363d9401eeb348efaa.exe -
Executes dropped EXE 37 IoCs
Processes:
dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exepid process 372 dllhost.exe 1040 dllhost.exe 2192 dllhost.exe 2872 dllhost.exe 4240 dllhost.exe 1228 dllhost.exe 4664 dllhost.exe 3560 dllhost.exe 784 dllhost.exe 3216 dllhost.exe 4616 dllhost.exe 3244 dllhost.exe 1496 dllhost.exe 3256 dllhost.exe 3124 dllhost.exe 3788 dllhost.exe 1664 dllhost.exe 4416 dllhost.exe 1644 dllhost.exe 496 dllhost.exe 4528 dllhost.exe 2484 dllhost.exe 3440 dllhost.exe 4312 dllhost.exe 552 dllhost.exe 2060 dllhost.exe 2448 dllhost.exe 4968 dllhost.exe 4352 dllhost.exe 1740 dllhost.exe 3288 dllhost.exe 2408 dllhost.exe 1476 dllhost.exe 876 dllhost.exe 3024 dllhost.exe 2520 dllhost.exe 2736 dllhost.exe -
Loads dropped DLL 64 IoCs
Processes:
dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exedllhost.exepid process 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 372 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 1040 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2192 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 2872 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 4240 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 1228 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 4664 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 3560 dllhost.exe 784 dllhost.exe 784 dllhost.exe 784 dllhost.exe 784 dllhost.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe upx C:\Users\Admin\AppData\Local\795e6f10\tor\libcrypto-1_1.dll upx behavioral3/memory/372-19-0x0000000000740000-0x0000000000B44000-memory.dmp upx C:\Users\Admin\AppData\Local\795e6f10\tor\libevent-2-1-6.dll upx C:\Users\Admin\AppData\Local\795e6f10\tor\libssp-0.dll upx C:\Users\Admin\AppData\Local\795e6f10\tor\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\795e6f10\tor\libwinpthread-1.dll upx C:\Users\Admin\AppData\Local\795e6f10\tor\zlib1.dll upx behavioral3/memory/372-32-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/372-33-0x0000000073670000-0x000000007373E000-memory.dmp upx C:\Users\Admin\AppData\Local\795e6f10\tor\libgcc_s_sjlj-1.dll upx behavioral3/memory/372-36-0x0000000073620000-0x0000000073669000-memory.dmp upx behavioral3/memory/372-37-0x00000000735F0000-0x0000000073614000-memory.dmp upx behavioral3/memory/372-38-0x00000000734E0000-0x00000000735EA000-memory.dmp upx behavioral3/memory/372-40-0x0000000073450000-0x00000000734D8000-memory.dmp upx behavioral3/memory/372-42-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/372-47-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-48-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/372-49-0x0000000073670000-0x000000007373E000-memory.dmp upx behavioral3/memory/372-50-0x0000000073620000-0x0000000073669000-memory.dmp upx behavioral3/memory/372-54-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/372-63-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-64-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-74-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-92-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-101-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-109-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-117-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-125-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/372-151-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/1040-152-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/1040-153-0x0000000073670000-0x000000007373E000-memory.dmp upx behavioral3/memory/1040-155-0x00000000735F0000-0x0000000073614000-memory.dmp upx behavioral3/memory/1040-154-0x0000000073620000-0x0000000073669000-memory.dmp upx behavioral3/memory/1040-157-0x0000000073450000-0x00000000734D8000-memory.dmp upx behavioral3/memory/1040-156-0x00000000734E0000-0x00000000735EA000-memory.dmp upx behavioral3/memory/1040-158-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/1040-150-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/1040-192-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/1040-193-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/1040-194-0x0000000073670000-0x000000007373E000-memory.dmp upx behavioral3/memory/1040-195-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/2192-251-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/2192-253-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/1040-252-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/2192-256-0x00000000735F0000-0x0000000073614000-memory.dmp upx behavioral3/memory/2192-255-0x0000000073620000-0x0000000073669000-memory.dmp upx behavioral3/memory/2192-258-0x00000000734E0000-0x00000000735EA000-memory.dmp upx behavioral3/memory/2192-259-0x0000000073450000-0x00000000734D8000-memory.dmp upx behavioral3/memory/2192-260-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/2192-254-0x0000000073670000-0x000000007373E000-memory.dmp upx behavioral3/memory/2192-269-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/2192-270-0x0000000073740000-0x0000000073808000-memory.dmp upx behavioral3/memory/2192-271-0x0000000073670000-0x000000007373E000-memory.dmp upx behavioral3/memory/2192-272-0x0000000073180000-0x000000007344F000-memory.dmp upx behavioral3/memory/2872-284-0x0000000073550000-0x000000007381F000-memory.dmp upx behavioral3/memory/2872-285-0x0000000073480000-0x0000000073548000-memory.dmp upx behavioral3/memory/2872-286-0x0000000073430000-0x0000000073479000-memory.dmp upx behavioral3/memory/2872-287-0x0000000073400000-0x0000000073424000-memory.dmp upx behavioral3/memory/2872-288-0x0000000073370000-0x00000000733F8000-memory.dmp upx behavioral3/memory/2872-289-0x0000000073260000-0x000000007336A000-memory.dmp upx behavioral3/memory/2872-291-0x0000000073190000-0x000000007325E000-memory.dmp upx behavioral3/memory/2872-307-0x0000000000740000-0x0000000000B44000-memory.dmp upx behavioral3/memory/2872-308-0x0000000073550000-0x000000007381F000-memory.dmp upx -
Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 60 myexternalip.com 164 myexternalip.com 228 myexternalip.com 264 myexternalip.com 61 myexternalip.com 105 myexternalip.com 210 myexternalip.com 238 myexternalip.com 256 myexternalip.com 94 myexternalip.com 143 myexternalip.com 181 myexternalip.com 114 myexternalip.com 155 myexternalip.com 197 myexternalip.com 248 myexternalip.com -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
Processes:
d151ec74b0a409363d9401eeb348efaa.exepid process 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d151ec74b0a409363d9401eeb348efaa.exedescription pid process Token: SeShutdownPrivilege 1220 d151ec74b0a409363d9401eeb348efaa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d151ec74b0a409363d9401eeb348efaa.exepid process 1220 d151ec74b0a409363d9401eeb348efaa.exe 1220 d151ec74b0a409363d9401eeb348efaa.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d151ec74b0a409363d9401eeb348efaa.exedescription pid process target process PID 1220 wrote to memory of 372 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 372 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 372 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1040 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1040 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1040 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2192 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2192 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2192 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2872 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2872 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2872 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4240 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4240 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4240 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1228 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1228 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1228 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3560 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3560 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3560 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 784 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 784 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 784 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3216 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3216 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3216 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4616 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4616 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4616 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3244 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3244 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3244 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3256 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3256 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3256 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3124 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3124 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3124 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3788 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3788 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 3788 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1664 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4416 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4416 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4416 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1644 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1644 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 1644 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 496 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4528 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4528 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 4528 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe PID 1220 wrote to memory of 2484 1220 d151ec74b0a409363d9401eeb348efaa.exe dllhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"C:\Users\Admin\AppData\Local\Temp\d151ec74b0a409363d9401eeb348efaa.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe"C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exe" -f torrc2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-certsFilesize
20KB
MD51faab9d6b65f4a37d866450e6dc66179
SHA181160c8f242c00710e46487d1112538d7b3591aa
SHA25671d2f739f77580a10067528053ed5b96551c9babf0b8f6893e4c15397db339f4
SHA512b4b26ddaa4f488053ac3bbdc7d607e00f79c7b54afd0d7b6e1e4a64420c7e9082da87c15bae536e67c16fa89a8ea0e74fff0745ecd68dceced0081bf07e40a80
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-microdesc-consensus.tmpFilesize
2.7MB
MD5fc147e3cb0df08b6d91acf950a9b8345
SHA1eba56b14666f0e9365bf7924e102d74037df45b3
SHA2562543eae35e8f149aa8a00cc10e0cd8a3eb152a75270ac5b297799a8a87ef1b02
SHA512e9607b1644b02448a12fd62aee74f5ab2c838cffa1256bb635c71629078f719a88dd3b504723e3668f71bc93ef01e4f1ceed8d331e71374ab8a4a674148dc5e9
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-microdescsFilesize
13.7MB
MD5bd5489c58f0ddba04befc6031cbae601
SHA15409b5497d036e4265a944032a433c044f92a765
SHA256574ecdc75f94d30c6af868c1b8369a081e944c66bb84b9d43d79c5ab3ca3978b
SHA512b5795cc569ddcf94bfe0e75915e58a859a30a82f121146bf8c05ab4c08a174eda45eabc7f760661d56f7cb5b7681b56c8948a0001e38f1b0233b87075d10af47
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-microdescs.newFilesize
6.7MB
MD535da2bbf8ddeccaeacae2cf5223fe783
SHA1c237758bed16e5fa872a5468f7956b43c813e156
SHA2561f2719470318771700f443142b4518ab3d894c5169663beb4df5ddb4192add99
SHA51218a4d169b923649d638d9bca0e3cb4f6b6036f4add8e27df77ca21c276489aab6f5d240b48581fefb62705966a9b7cfe04b0a582879a7b6ceb486233737c1928
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-microdescs.newFilesize
13.7MB
MD522fc2138af31041d63a5a9ed3f87d8bf
SHA1a92adbffe8b9fbf80a946e57dfbb85e794ab0468
SHA256764bb8985ecc19447f3eea70667f074126097497535d22333e7b48c604f56b64
SHA512126ec70f069409feb8780578881d5ca12adfae53ada6e31e90a4259628424df8e43440eb54de82d23575ccc10567fad150e9179b041259ca32c9f4fc051a5952
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\cached-microdescs.newFilesize
8.0MB
MD575c92076c452f3a5b1e481ebe8e4d694
SHA1f90df791280350fc5c1c99c42537ca6f81d8c85e
SHA25643459318250b3c646905742de524c2e118611eff1b9594a211688ddeb74a3d15
SHA5129e5c714b5fd6279d1f686b541c29b5dda6b37a6a250f6234e7cf4cd0d1538ca29c6c43a4b7e51dbf2f4ec65e2335d37bb380623fe28b41eed0dc4ee3911bbd19
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\stateFilesize
3KB
MD5c9f83cde49632b33a6d1c03db07651cb
SHA19245be660f23b4b8eed98fea1db1ba5f963c3585
SHA25611c0020c034fc417114a7749aa950d303e31592139cb9ecf2968e3df591479a7
SHA51200cbf7d91d847fbdd63b898623034d4fcc9228c309616a69e9be3946e2f49ccb95bde503b028778a139e29546a089de7c05ee50db94cae66affe19fb41e9fee7
-
C:\Users\Admin\AppData\Local\795e6f10\tor\data\stateFilesize
232B
MD54ce5a1486079504307735ecb6402ed90
SHA10ea1986895b230546d891a2d021e4b17646fc577
SHA256e0c9981d00dcb98438e95346220c6e6fcc37f8153cd9df9dedf62bab471efa40
SHA512bdb2049dd94e13e5e35bac16f54708076d5b546856d24ee286748faa43feb6f7d443fb39a290c97d80cc63e9103142c15fa767e42fab1cff2eb9c86b5d07b4eb
-
C:\Users\Admin\AppData\Local\795e6f10\tor\dllhost.exeFilesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libcrypto-1_1.dllFilesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libevent-2-1-6.dllFilesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libgcc_s_sjlj-1.dllFilesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libssl-1_1.dllFilesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libssp-0.dllFilesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
C:\Users\Admin\AppData\Local\795e6f10\tor\libwinpthread-1.dllFilesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
C:\Users\Admin\AppData\Local\795e6f10\tor\torrcFilesize
157B
MD5eebf3cf47a1beca7d42881292f826fcc
SHA1a37799483175f02dc9913f25389c574c13996164
SHA2569e45d5a6d2715a70dc3783af1e049de4defe98c2cc574d6ec8e0c1539874d6d7
SHA5124157e0f3d73f8c39fb93e0f80f01ba2a83fd20863fe10078fc75d061e19798850f34c9053bd0449c5c6b508682cfa5b8c505fe085e30b46d18305396389e2800
-
C:\Users\Admin\AppData\Local\795e6f10\tor\zlib1.dllFilesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa
-
memory/372-33-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/372-74-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-43-0x00000000013E0000-0x00000000016AF000-memory.dmpFilesize
2.8MB
-
memory/372-40-0x0000000073450000-0x00000000734D8000-memory.dmpFilesize
544KB
-
memory/372-47-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-48-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/372-49-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/372-50-0x0000000073620000-0x0000000073669000-memory.dmpFilesize
292KB
-
memory/372-54-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/372-39-0x0000000000B50000-0x0000000000BD8000-memory.dmpFilesize
544KB
-
memory/372-63-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-64-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-72-0x0000000000B50000-0x0000000000BD8000-memory.dmpFilesize
544KB
-
memory/372-42-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/372-38-0x00000000734E0000-0x00000000735EA000-memory.dmpFilesize
1.0MB
-
memory/372-92-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-37-0x00000000735F0000-0x0000000073614000-memory.dmpFilesize
144KB
-
memory/372-101-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-109-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-117-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-125-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-151-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/372-36-0x0000000073620000-0x0000000073669000-memory.dmpFilesize
292KB
-
memory/372-32-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/372-19-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/1040-158-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/1040-195-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/1040-156-0x00000000734E0000-0x00000000735EA000-memory.dmpFilesize
1.0MB
-
memory/1040-157-0x0000000073450000-0x00000000734D8000-memory.dmpFilesize
544KB
-
memory/1040-150-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/1040-154-0x0000000073620000-0x0000000073669000-memory.dmpFilesize
292KB
-
memory/1040-155-0x00000000735F0000-0x0000000073614000-memory.dmpFilesize
144KB
-
memory/1040-153-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/1040-152-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/1040-252-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/1040-192-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/1040-193-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/1040-194-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/1220-306-0x00000000742C0000-0x00000000742F9000-memory.dmpFilesize
228KB
-
memory/1220-327-0x0000000072D70000-0x0000000072DA9000-memory.dmpFilesize
228KB
-
memory/1220-100-0x00000000742E0000-0x0000000074319000-memory.dmpFilesize
228KB
-
memory/1220-191-0x0000000072FE0000-0x0000000073019000-memory.dmpFilesize
228KB
-
memory/1220-46-0x0000000072D70000-0x0000000072DA9000-memory.dmpFilesize
228KB
-
memory/1220-305-0x0000000071E60000-0x0000000071E99000-memory.dmpFilesize
228KB
-
memory/1220-0-0x00000000742C0000-0x00000000742F9000-memory.dmpFilesize
228KB
-
memory/2192-254-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/2192-260-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/2192-251-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/2192-269-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/2192-270-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/2192-271-0x0000000073670000-0x000000007373E000-memory.dmpFilesize
824KB
-
memory/2192-272-0x0000000073180000-0x000000007344F000-memory.dmpFilesize
2.8MB
-
memory/2192-259-0x0000000073450000-0x00000000734D8000-memory.dmpFilesize
544KB
-
memory/2192-258-0x00000000734E0000-0x00000000735EA000-memory.dmpFilesize
1.0MB
-
memory/2192-255-0x0000000073620000-0x0000000073669000-memory.dmpFilesize
292KB
-
memory/2192-256-0x00000000735F0000-0x0000000073614000-memory.dmpFilesize
144KB
-
memory/2192-253-0x0000000073740000-0x0000000073808000-memory.dmpFilesize
800KB
-
memory/2872-289-0x0000000073260000-0x000000007336A000-memory.dmpFilesize
1.0MB
-
memory/2872-318-0x0000000073190000-0x000000007325E000-memory.dmpFilesize
824KB
-
memory/2872-291-0x0000000073190000-0x000000007325E000-memory.dmpFilesize
824KB
-
memory/2872-287-0x0000000073400000-0x0000000073424000-memory.dmpFilesize
144KB
-
memory/2872-286-0x0000000073430000-0x0000000073479000-memory.dmpFilesize
292KB
-
memory/2872-285-0x0000000073480000-0x0000000073548000-memory.dmpFilesize
800KB
-
memory/2872-307-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/2872-308-0x0000000073550000-0x000000007381F000-memory.dmpFilesize
2.8MB
-
memory/2872-317-0x0000000073480000-0x0000000073548000-memory.dmpFilesize
800KB
-
memory/2872-288-0x0000000073370000-0x00000000733F8000-memory.dmpFilesize
544KB
-
memory/2872-284-0x0000000073550000-0x000000007381F000-memory.dmpFilesize
2.8MB
-
memory/2872-364-0x0000000000740000-0x0000000000B44000-memory.dmpFilesize
4.0MB
-
memory/4240-362-0x0000000073480000-0x0000000073548000-memory.dmpFilesize
800KB
-
memory/4240-365-0x0000000073190000-0x000000007325E000-memory.dmpFilesize
824KB
-
memory/4240-360-0x0000000073550000-0x000000007381F000-memory.dmpFilesize
2.8MB
-
memory/4240-366-0x0000000073430000-0x0000000073479000-memory.dmpFilesize
292KB
-
memory/4240-367-0x0000000073400000-0x0000000073424000-memory.dmpFilesize
144KB
-
memory/4240-368-0x0000000073260000-0x000000007336A000-memory.dmpFilesize
1.0MB
-
memory/4240-369-0x0000000073370000-0x00000000733F8000-memory.dmpFilesize
544KB