1bd4fe07daaeb321a120cfbd1d02fdfefc2dae30b4dfa50adff0f85939d88792

Analysis

max time kernel
116s
max time network
149s
platform
windows7_x64
resource
win7v20210408
submitted
24-09-2021 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
Size

2.0MB
MD5

18b8ceb513bf65ab8247b72db430f19a
SHA1

558333e3f128a05d75a2ad77af0bb5bbb7848c88
SHA256

3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c
SHA512

e56eb94bf9ea21b52c84b71ce77c6c372a8b54e7a2bb61d5f8903bd6dbb549b6038fd9c02e25886e580dfbcf63e30894fcdac65e1219fe59a83e567ab8d1e16b

Score

10^/10

pyinstaller suricata

Malware Config

Signatures

suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata

Executes dropped EXE 11 IoCs

Processes:

zeronet-downloader.exeZeroNet.exeZeroNet-cli.exeopenssl.exeopenssl.exeopenssl.exetor.exemeek-client.exeopenssl.exeopenssl.exeopenssl.exe

pid	process
1976	zeronet-downloader.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1812	openssl.exe
1572	openssl.exe
1732	openssl.exe
1576	tor.exe
848	meek-client.exe
1516	openssl.exe
1444	openssl.exe
2032	openssl.exe

Loads dropped DLL 64 IoCs

Processes:

3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exeZeroNet.execmd.exeZeroNet-cli.exe

pid	process
1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1496	cmd.exe
1496	cmd.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1404	ZeroNet.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1400	ZeroNet-cli.exe
1404	ZeroNet.exe

Detects Pyinstaller 9 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe	pyinstaller
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\ZeroNet-cli.dat	pyinstaller
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe	pyinstaller
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe	pyinstaller
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exeopenssl.exeopenssl.exeopenssl.exetor.exeopenssl.exeopenssl.exeopenssl.exe

pid	process
1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
1812	openssl.exe
1812	openssl.exe
1572	openssl.exe
1572	openssl.exe
1732	openssl.exe
1732	openssl.exe
1576	tor.exe
1576	tor.exe
1516	openssl.exe
1516	openssl.exe
1576	tor.exe
1444	openssl.exe
1444	openssl.exe
2032	openssl.exe
2032	openssl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ZeroNet-cli.exeZeroNet.exe

description pid process

Token: 35 1400 ZeroNet-cli.exe
Token: 35 1404 ZeroNet.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ZeroNet.exe

pid process

1404 ZeroNet.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

ZeroNet.exe

pid process

1404 ZeroNet.exe

description	pid	process
Token: 35	1400	ZeroNet-cli.exe
Token: 35	1404	ZeroNet.exe

pid	process
1404	ZeroNet.exe

pid	process
1404	ZeroNet.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.execmd.exeZeroNet-cli.execmd.execmd.execmd.exetor.exeZeroNet.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1972 wrote to memory of 1976	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	zeronet-downloader.exe
PID 1972 wrote to memory of 1976	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	zeronet-downloader.exe
PID 1972 wrote to memory of 1976	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	zeronet-downloader.exe
PID 1972 wrote to memory of 1404	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	ZeroNet.exe
PID 1972 wrote to memory of 1404	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	ZeroNet.exe
PID 1972 wrote to memory of 1404	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	ZeroNet.exe
PID 1972 wrote to memory of 1496	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	cmd.exe
PID 1972 wrote to memory of 1496	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	cmd.exe
PID 1972 wrote to memory of 1496	1972	3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe	cmd.exe
PID 1496 wrote to memory of 1400	1496	cmd.exe	ZeroNet-cli.exe
PID 1496 wrote to memory of 1400	1496	cmd.exe	ZeroNet-cli.exe
PID 1496 wrote to memory of 1400	1496	cmd.exe	ZeroNet-cli.exe
PID 1400 wrote to memory of 1944	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1944	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1944	1400	ZeroNet-cli.exe	cmd.exe
PID 1944 wrote to memory of 1812	1944	cmd.exe	openssl.exe
PID 1944 wrote to memory of 1812	1944	cmd.exe	openssl.exe
PID 1944 wrote to memory of 1812	1944	cmd.exe	openssl.exe
PID 1400 wrote to memory of 1096	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1096	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1096	1400	ZeroNet-cli.exe	cmd.exe
PID 1096 wrote to memory of 1572	1096	cmd.exe	openssl.exe
PID 1096 wrote to memory of 1572	1096	cmd.exe	openssl.exe
PID 1096 wrote to memory of 1572	1096	cmd.exe	openssl.exe
PID 1400 wrote to memory of 1500	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1500	1400	ZeroNet-cli.exe	cmd.exe
PID 1400 wrote to memory of 1500	1400	ZeroNet-cli.exe	cmd.exe
PID 1500 wrote to memory of 1732	1500	cmd.exe	openssl.exe
PID 1500 wrote to memory of 1732	1500	cmd.exe	openssl.exe
PID 1500 wrote to memory of 1732	1500	cmd.exe	openssl.exe
PID 1400 wrote to memory of 1576	1400	ZeroNet-cli.exe	tor.exe
PID 1400 wrote to memory of 1576	1400	ZeroNet-cli.exe	tor.exe
PID 1400 wrote to memory of 1576	1400	ZeroNet-cli.exe	tor.exe
PID 1400 wrote to memory of 1576	1400	ZeroNet-cli.exe	tor.exe
PID 1576 wrote to memory of 848	1576	tor.exe	meek-client.exe
PID 1576 wrote to memory of 848	1576	tor.exe	meek-client.exe
PID 1576 wrote to memory of 848	1576	tor.exe	meek-client.exe
PID 1576 wrote to memory of 848	1576	tor.exe	meek-client.exe
PID 1404 wrote to memory of 1564	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1564	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1564	1404	ZeroNet.exe	cmd.exe
PID 1564 wrote to memory of 1516	1564	cmd.exe	openssl.exe
PID 1564 wrote to memory of 1516	1564	cmd.exe	openssl.exe
PID 1564 wrote to memory of 1516	1564	cmd.exe	openssl.exe
PID 1404 wrote to memory of 1820	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1820	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1820	1404	ZeroNet.exe	cmd.exe
PID 1820 wrote to memory of 1444	1820	cmd.exe	openssl.exe
PID 1820 wrote to memory of 1444	1820	cmd.exe	openssl.exe
PID 1820 wrote to memory of 1444	1820	cmd.exe	openssl.exe
PID 1404 wrote to memory of 1008	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1008	1404	ZeroNet.exe	cmd.exe
PID 1404 wrote to memory of 1008	1404	ZeroNet.exe	cmd.exe
PID 1008 wrote to memory of 2032	1008	cmd.exe	openssl.exe
PID 1008 wrote to memory of 2032	1008	cmd.exe	openssl.exe
PID 1008 wrote to memory of 2032	1008	cmd.exe	openssl.exe

C:\Users\Admin\AppData\Local\Temp\3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe
"C:\Users\Admin\AppData\Local\Temp\3cb01d4470bd82701dc1879cee898d7331ea17df13472d311b55b1ecd4546e1c.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
"C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe"
2⤵
- Executes dropped EXE
PID:1976

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe
"C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe" --open_browser ""
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" req -new -newkey rsa:2048 -days 3650 -nodes -x509 -config "src/lib/openssl/openssl.cnf" -subj "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA" -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -batch"
3⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" req -new -newkey rsa:2048 -days 3650 -nodes -x509 -config "src/lib/openssl/openssl.cnf" -subj "/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA" -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -batch
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" req -new -newkey rsa:2048 -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/key-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -subj "/CN=python.org" -sha256 -nodes -batch -config "src/lib/openssl/openssl.cnf""
3⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" req -new -newkey rsa:2048 -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/key-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -subj "/CN=python.org" -sha256 -nodes -batch -config "src/lib/openssl/openssl.cnf"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" x509 -req -in "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -CA "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -CAkey "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -set_serial 01 -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.pem" -days 730 -sha256 -extensions x509_ext -extfile "src/lib/openssl/openssl.cnf""
3⤵
- Suspicious use of WriteProcessMemory
PID:1008

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" x509 -req -in "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -CA "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -CAkey "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -set_serial 01 -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.pem" -days 730 -sha256 -extensions x509_ext -extfile "src/lib/openssl/openssl.cnf"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2032

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\ZeroNet.cmd" siteDownload 12Lsmag4b4sKeGNx1os44UFcGcw58FZmPr"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1496

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe
..\ZeroNet-cli.exe --open_browser False siteDownload 12Lsmag4b4sKeGNx1os44UFcGcw58FZmPr
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" req -new -newkey rsa:2048 -days 3650 -nodes -x509 -config "src/lib/openssl/openssl.cnf" -subj "/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3" -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -batch"
4⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" req -new -newkey rsa:2048 -days 3650 -nodes -x509 -config "src/lib/openssl/openssl.cnf" -subj "/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3" -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -batch
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" req -new -newkey rsa:2048 -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/key-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -subj "/CN=rambler.ru" -sha256 -nodes -batch -config "src/lib/openssl/openssl.cnf""
4⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" req -new -newkey rsa:2048 -keyout "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/key-rsa.pem" -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -subj "/CN=rambler.ru" -sha256 -nodes -batch -config "src/lib/openssl/openssl.cnf"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""tools\openssl\openssl.exe" x509 -req -in "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -CA "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -CAkey "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -set_serial 01 -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.pem" -days 730 -sha256 -extensions x509_ext -extfile "src/lib/openssl/openssl.cnf""
4⤵
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\openssl\openssl.exe
"tools\openssl\openssl.exe" x509 -req -in "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.csr" -CA "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cacert-rsa.pem" -CAkey "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cakey-rsa.pem" -set_serial 01 -out "C:/Users/Admin/AppData/Roaming/ZeroNet Filesharing Tool/ZeroNet-win-dist-win64/data/cert-rsa.pem" -days 730 -sha256 -extensions x509_ext -extfile "src/lib/openssl/openssl.cnf"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1732

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\tor\tor.exe
tools/tor/tor.exe -f torrc --defaults-torrc torrc-defaults --ignore-missing-torrc
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\tools\tor\PluggableTransports\meek-client.exe
PluggableTransports/meek-client
5⤵
- Executes dropped EXE
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64.zip
MD5
bf04780a88a28be1cc24878b348dd49a

SHA1
4c496b5bcae2ff97bbb9ef4bfc8ab8e007a6fa7b

SHA256
3621349b45ad40a020710607c78e03294b783272240af12a084669478c6a16c6

SHA512
da9b0f06642fe2f10c975c8480eac99e69f1f2febc8d56c23e862aa71ec03bba7a048c6acc520af94f0e486d0f6ebfa15dfdc843c09f9c2b7fc516f16f71b915

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\VCRUNTIME140.dll
MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe
MD5
54212ab20b0a5ec287ac786fbfeb269e

SHA1
e8d06e6b70eae4170b79897c13044e9e29bb43ed

SHA256
c24bc651b14e67fdfbe4eeff6accc88cfa4076e6b4ba484f485255b31203c7db

SHA512
7a13cea2e1c1cbad585ed967c622b868d15674bd1b6955a21525f06a2a1db9032456906eeb52da361dfeb4c30759c95263624e68f8d1e701009ee15cd83bc438

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe
MD5
54212ab20b0a5ec287ac786fbfeb269e

SHA1
e8d06e6b70eae4170b79897c13044e9e29bb43ed

SHA256
c24bc651b14e67fdfbe4eeff6accc88cfa4076e6b4ba484f485255b31203c7db

SHA512
7a13cea2e1c1cbad585ed967c622b868d15674bd1b6955a21525f06a2a1db9032456906eeb52da361dfeb4c30759c95263624e68f8d1e701009ee15cd83bc438

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.pkg
MD5
fcb339b8c1076693c69bccf2f415ecb9

SHA1
3cc585c3f692bec14b3b95b714905454b4301293

SHA256
6be2f92c439e9888fb6c51d2dee5d8144eaf180da8e7639db3eac4e586d6a4a9

SHA512
1441a1dba1033db527d5d613d4097ef986978d5ebb5118813fc6f16a81d025fd1c3e7d7e647f3b8dd2b87544ebb201b75b323b1721b8b760dae68252791047cc

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe
MD5
64848426d64b9f6eba3739ce1890e427

SHA1
1d418d95b288700af12dba7e42ac159627188131

SHA256
be070944e245e339c3ffadfdaeb30ae8cc3171b7c6959b1653674482ec09d089

SHA512
e4b3c1a20378c5da9d1ab5a162b4749f36d926f9a454f4474b265a622b2555522937424f38b7fb4c0458ce9d2bee247200b744ad787463ca68c044eeb34d04b7

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe
MD5
64848426d64b9f6eba3739ce1890e427

SHA1
1d418d95b288700af12dba7e42ac159627188131

SHA256
be070944e245e339c3ffadfdaeb30ae8cc3171b7c6959b1653674482ec09d089

SHA512
e4b3c1a20378c5da9d1ab5a162b4749f36d926f9a454f4474b265a622b2555522937424f38b7fb4c0458ce9d2bee247200b744ad787463ca68c044eeb34d04b7

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.pkg
MD5
fcb339b8c1076693c69bccf2f415ecb9

SHA1
3cc585c3f692bec14b3b95b714905454b4301293

SHA256
6be2f92c439e9888fb6c51d2dee5d8144eaf180da8e7639db3eac4e586d6a4a9

SHA512
1441a1dba1033db527d5d613d4097ef986978d5ebb5118813fc6f16a81d025fd1c3e7d7e647f3b8dd2b87544ebb201b75b323b1721b8b760dae68252791047cc

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\base_library.zip
MD5
ba1612c38044c8c944c15284d3681814

SHA1
e1a799dfa9f936ebedcde65eed8fc34e06adbe28

SHA256
62fa3e16baa20ad022009eaebdc306ab255d8f50644bdd78e5889e317ac3ba52

SHA512
f4bc319714e4d8060ba1536202669f28a349da9c296f89ec7202f6ae617e31b9fe9f33ccd327cbf98a84e0c08120b6df7077204f9525af70d80ff0953fca6340

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\src\main.py
MD5
1f88293ead652fad8646cf4ddcf863a2

SHA1
08699dd71a8c0902fa1281eba572b3ba2df6fbdc

SHA256
b7ec0781e12b3d2174b8dd5ffdfa194266bcc7ac0d3be1c53405d3c231091cc4

SHA512
311f1416cbd47982d93a943e98a76e6c1c35803d3f92f6b933cb7b36e54956033bb0c8913298195f66c71bae8e343956d166d05bd0416eaddbbf8de4ded4de38

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\core\zeronet.py
MD5
d59e845ee6777519e9917135cca2a6dd

SHA1
b727fa5a49470af07570bc14b76905c33feedcfe

SHA256
20d88354597b2704a5674c38c42f2122541e347140e30c1c1786d044357af8e2

SHA512
cf2dbd8355656b8bf147071f02ff2f8e44fe4c7bb289368cf0c1d3bf812426024270cb89957a6849671021a49381730ca73f0ee0a50840cb02b3a565bc81d2e8

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\ZeroNet-cli.dat
MD5
54212ab20b0a5ec287ac786fbfeb269e

SHA1
e8d06e6b70eae4170b79897c13044e9e29bb43ed

SHA256
c24bc651b14e67fdfbe4eeff6accc88cfa4076e6b4ba484f485255b31203c7db

SHA512
7a13cea2e1c1cbad585ed967c622b868d15674bd1b6955a21525f06a2a1db9032456906eeb52da361dfeb4c30759c95263624e68f8d1e701009ee15cd83bc438

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\ZeroNet.cmd
MD5
55e3c03e3d8c674be9066481aa8b2e6f

SHA1
b395dedaf9d4b808f7a76321ce81987629bbb0d9

SHA256
93071cc72fcdd16504f3b542c5855fc91c2fc1f4c328a5a1d9507a925fbdc14a

SHA512
e37b69244839ac9c52b7bf509ba506e4276bd7033cde63b8d583960b5d7a376c65e768d5b574edae1927853f3a4cc072e7c7dfa62486a6658d26909f3d6c1619

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_bz2.pyd
MD5
429ad9f0d7240a1eb9c108b2d7c1382f

SHA1
f54e1c1d31f5dd6698e47750daf48b9291b9ea69

SHA256
d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

SHA512
bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_cffi_backend.cp37-win_amd64.pyd
MD5
178e59320ad837ee085b52f633eeae6e

SHA1
dffe0e46694a0e784bc41e4702ba306c53148363

SHA256
750f7b735e09feee3323db8e0f20b88d600f3155bea2124efeb52d998f43b565

SHA512
9604633e5b726c2cf7394684735b6d441eddb786cf863dbae89d2b16b642d6f7f23fed56a8bf13b366984e6ae19e1134f4891bb369ad3aa35bc4f75de87e94bb

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_ctypes.pyd
MD5
985d2c5623def9d80d1408c01a8628be

SHA1
317c298cb2e1728f9c7f14de2f7764c9861be101

SHA256
7257178f704cd43e68cd7bc80f9814385b2e5d4f35d6e198ae99dce9f4118976

SHA512
be6a9d3465a5e00e6752a4b681fb8ef75126b132965624d4373b8817d68ed11337b068034ebedcfe59fb9486b86a03e67e81badc29375a776f366bf7f834f0dc

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_hashlib.pyd
MD5
d61618c28373d7bbdf1dec7ec2b2b1c1

SHA1
51f4bab84620752aedf7d71dcccb577ed518e9fd

SHA256
33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

SHA512
ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_lzma.pyd
MD5
5e7a6b749a05dd934ee4471411420053

SHA1
fcd1e54011b98928edbb3820a5838568b9573453

SHA256
4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

SHA512
ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_socket.pyd
MD5
7c5c5e6e4ed888dd26c7aa063bb9f88e

SHA1
a7a3694739b27c3d34beb1a9730fc3dcbae6744a

SHA256
2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

SHA512
9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\__init__.py
MD5
e9d8c62f860b28ab492819aac6fd5c97

SHA1
9561a402422d1a0ea534717cfd251aad9d4c0aaf

SHA256
2e6a96f1febcd3af06c646919626471e90edfcec79929e849be1d441ff74be5f

SHA512
379a0ed96ac03f4b966ff4e20059a294234baa2e7b52c1c3f5f3204d400eecdd15651c61ecd82f1253875e3c9a952d619d4b3dda85bd62599f68e6cb8f80be5b

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_compat.py
MD5
b24b87e46e02bb99db9c3a0e1fddcd45

SHA1
1296d28a4852978f4f5e845f55b2aba191dd3d2b

SHA256
5bc3fe55b139260194b5473d78e00a95e0c505d8bf201588110c9281e643557e

SHA512
82ee59fde7a5b752817a8dc019f6e5f243b5a4ce0ed8bf66448ca39e7a29e476423ae09a9e75f41e9e134114d11b5927a81880d7fb87c16fe1053a0359048438

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_config.py
MD5
a7473672cf18b8802da714387e24d674

SHA1
7356dc7f8c28074c029c69ecb31003f31394c5fc

SHA256
cc59c9ca8896dfd8bded36af2bd5397efc4f3b73ba9f70763013f56efd19f1d7

SHA512
d73a68e9dabda6e37f3ab012ba670d9891195cc806f0e33b262c125d474ea17a9807e7e5a855f8d47cdadfe48987d4d04e126699fe1e1c20cbaca8af25ed3759

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_ffi\__init__.py
MD5
4952c11c89373764c34d9c8918cb738d

SHA1
420a926ef6d69ca14c2ba651eda970766aec4e46

SHA256
0530608e3bcee1e71004f6d178185e9bed33bf2d4caba8d77f974caf2906221b

SHA512
68b67b51f6a0f5e6e2fb6d49649f271298b87ad90f18117b3300863bc591bd7cc895589533c071f18631604b3d8fa5e9fe7c4e648cf76c9c1bc0556baa432e23

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_ffi\callback.py
MD5
3d212024df408063eebeb2e6c8a30db1

SHA1
0da7fd1df5cad2640fafe4c01597442cf778f52d

SHA256
5d1f0d965e42897e10283c1f94f2e95a3d7e05a50673091ad10bcedeaaa937cb

SHA512
9df585137ecf3232b8a41cec73479dc183c67dd38559e6a547e73892f172e728577f9715b63b6f2a5027aed0c283513ce2338fb4e053b65ab21ac1ef33a4ca3d

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_ffi\loop.py
MD5
38800c5ee1756bb798b53fc9d526f6e2

SHA1
fd7d7ee6757f6e083f7cf72321f2ebbc7543a6f8

SHA256
62397d14a4a5d5e5df16c0a2e71ae5c4a53021f50a2036c5b91be8ffd13512b2

SHA512
3f84a23235b348a63b27d1a3e6006077d82e2e7abf090608cbe8fa587cb972bb659e9aec3d4069138ba976c92784f1121d6e04b541c317aa1de9d07d167d1a0a

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_interfaces.py
MD5
cc606cdb5b307ee5e817e53c07e9f1eb

SHA1
ddb8993b961b62553b1a2fba9cd2f121741c34e9

SHA256
d0cc222c9fe623e7cde877b04e68258ccf7743d1894b1d367f93dfe015026fcc

SHA512
38dba372bec22cfdcf54f33c98626dccef64e4809bde37517727d773828a089f1204809eff107d253b696e93f53f187d9369a5b451f06c8d4288568338d27154

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\_util.py
MD5
e03d473c69b08f22a6588ebf70ae4efa

SHA1
b00fcd01d3f629619ad3d9de3a6f59fcb651530a

SHA256
68e6a90009ecae5d4da81380911469c18671bb4428ad70953c6b96ecbd9cbb50

SHA512
80febfdb736571e63c41ec5fff17156a44f8aa487a879d992150d41741d53a98dbfb22edfce84045d8524a1d61198c4741d32ce2305b85240f31b69db7ff9cfe

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\libuv\__init__.py
MD5
cf158c94db3d0d4955b843d9a5cc0634

SHA1
2b77863821302f6507155853eaedbf9d1637ca91

SHA256
23a8696052429db0410eba2eb0acd9ed097efa69df005c1f336ab506ec5c31f2

SHA512
f575bb9fd204cafda301402c0130e9a24650d2e86140130c56ac049f1ed0acf504af10a263b91bbcf35d27893e2cdd631a39872c6ac69952343a201028a5b8ae

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\libuv\_corecffi.cp37-win_amd64.pyd
MD5
5661a74845831bb9b81cdc507e0f15be

SHA1
a43e0cfb8c83e78379bb0e0df23735780f2643c8

SHA256
b0e30abbb55ca4be12178a1577db821d0d1d5bcadbdf0e989764d074a83a8860

SHA512
623f6cf5e0ba56101820a3e839e868a831a5d928aab2493e2c089e7e4bdd6ae13f8cc29ab33a2183eeff12f0c34cd92b4be59803b65b053961670fbebe346f34

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\libuv\loop.py
MD5
37a0a82e97171245a6853fdf1d34ac21

SHA1
983a8c300d0336dca414d7924a468330cabfb3e2

SHA256
73cdb50652535ceea426051c4938f2429bc2115d78c36db1d7032f9e101a6883

SHA512
d434ead827a5198e218bafd0b2a97bb5f0bf0463949e45ba5688a89d3377ae7bfe6cce457c258a471ae2473cd77a9b94379d6d503b93e7530c8cf80e855bfc7e

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\libuv\watcher.py
MD5
7c8ae252743f0567c4168069addf8ff2

SHA1
672cc7bd1bb8881667355f5a74774dce1fca1553

SHA256
d56e2dfb0ae1c227c1a8b1b085a6ce908e32346b25df27f8f1925c9093de9aea

SHA512
039f4c1f92db70a3398f56a8d090129d6d5ca04b383fc93b3e09c7208e2bbc822823eec3d5189ac39195f1befd71b110e2d8c97427ecb6ac699dde2f387b6b09

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\libcrypto-1_1-x64.dll
MD5
8c75bca5ea3bea4d63f52369e3694d01

SHA1
a0c0fd3d9e5688d75386094979171dbde2ce583a

SHA256
8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

SHA512
6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\pyexpat.pyd
MD5
a045432966523928d20b7dce4537c776

SHA1
0869868b4548ec7b0bddf7539b6022185bc3f6da

SHA256
d4ca4589c6c8ff5a9f71da2f63c1d214bfeb8662375b42ee201b7c9e07c586a6

SHA512
bdab5104b9cc278608cdc6662f38855c3a7c348d372034790c120209cbdf9730bbcece9dd1a59f8060d3dc29f5f193b988c9273b6eec5987bddc94cc28a9bc9b

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\select.pyd
MD5
1650617f3378c5bd469906ae1256a54c

SHA1
dd89ffd426b6820fd79631e4c99760cb485d3a67

SHA256
5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

SHA512
89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\python37.dll
MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
C:\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\VCRUNTIME140.dll
MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\VCRUNTIME140.dll
MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe
MD5
54212ab20b0a5ec287ac786fbfeb269e

SHA1
e8d06e6b70eae4170b79897c13044e9e29bb43ed

SHA256
c24bc651b14e67fdfbe4eeff6accc88cfa4076e6b4ba484f485255b31203c7db

SHA512
7a13cea2e1c1cbad585ed967c622b868d15674bd1b6955a21525f06a2a1db9032456906eeb52da361dfeb4c30759c95263624e68f8d1e701009ee15cd83bc438

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet-cli.exe
MD5
54212ab20b0a5ec287ac786fbfeb269e

SHA1
e8d06e6b70eae4170b79897c13044e9e29bb43ed

SHA256
c24bc651b14e67fdfbe4eeff6accc88cfa4076e6b4ba484f485255b31203c7db

SHA512
7a13cea2e1c1cbad585ed967c622b868d15674bd1b6955a21525f06a2a1db9032456906eeb52da361dfeb4c30759c95263624e68f8d1e701009ee15cd83bc438

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe
MD5
64848426d64b9f6eba3739ce1890e427

SHA1
1d418d95b288700af12dba7e42ac159627188131

SHA256
be070944e245e339c3ffadfdaeb30ae8cc3171b7c6959b1653674482ec09d089

SHA512
e4b3c1a20378c5da9d1ab5a162b4749f36d926f9a454f4474b265a622b2555522937424f38b7fb4c0458ce9d2bee247200b744ad787463ca68c044eeb34d04b7

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\ZeroNet.exe
MD5
64848426d64b9f6eba3739ce1890e427

SHA1
1d418d95b288700af12dba7e42ac159627188131

SHA256
be070944e245e339c3ffadfdaeb30ae8cc3171b7c6959b1653674482ec09d089

SHA512
e4b3c1a20378c5da9d1ab5a162b4749f36d926f9a454f4474b265a622b2555522937424f38b7fb4c0458ce9d2bee247200b744ad787463ca68c044eeb34d04b7

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_bz2.pyd
MD5
429ad9f0d7240a1eb9c108b2d7c1382f

SHA1
f54e1c1d31f5dd6698e47750daf48b9291b9ea69

SHA256
d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

SHA512
bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_bz2.pyd
MD5
429ad9f0d7240a1eb9c108b2d7c1382f

SHA1
f54e1c1d31f5dd6698e47750daf48b9291b9ea69

SHA256
d2571d3a553ea586fb1e5695dd9745caef9f0e30ac5b876d1307678360674f38

SHA512
bae51da3560e0a720d45f0741f9992fe0729ead0112a614dba961c50cd6f82ddbdcf7b47aeda4f1093f6654f6db77d767ccddd59d34d2143df54121e9d486760

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_cffi_backend.cp37-win_amd64.pyd
MD5
178e59320ad837ee085b52f633eeae6e

SHA1
dffe0e46694a0e784bc41e4702ba306c53148363

SHA256
750f7b735e09feee3323db8e0f20b88d600f3155bea2124efeb52d998f43b565

SHA512
9604633e5b726c2cf7394684735b6d441eddb786cf863dbae89d2b16b642d6f7f23fed56a8bf13b366984e6ae19e1134f4891bb369ad3aa35bc4f75de87e94bb

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_ctypes.pyd
MD5
985d2c5623def9d80d1408c01a8628be

SHA1
317c298cb2e1728f9c7f14de2f7764c9861be101

SHA256
7257178f704cd43e68cd7bc80f9814385b2e5d4f35d6e198ae99dce9f4118976

SHA512
be6a9d3465a5e00e6752a4b681fb8ef75126b132965624d4373b8817d68ed11337b068034ebedcfe59fb9486b86a03e67e81badc29375a776f366bf7f834f0dc

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_ctypes.pyd
MD5
985d2c5623def9d80d1408c01a8628be

SHA1
317c298cb2e1728f9c7f14de2f7764c9861be101

SHA256
7257178f704cd43e68cd7bc80f9814385b2e5d4f35d6e198ae99dce9f4118976

SHA512
be6a9d3465a5e00e6752a4b681fb8ef75126b132965624d4373b8817d68ed11337b068034ebedcfe59fb9486b86a03e67e81badc29375a776f366bf7f834f0dc

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_hashlib.pyd
MD5
d61618c28373d7bbdf1dec7ec2b2b1c1

SHA1
51f4bab84620752aedf7d71dcccb577ed518e9fd

SHA256
33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

SHA512
ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_hashlib.pyd
MD5
d61618c28373d7bbdf1dec7ec2b2b1c1

SHA1
51f4bab84620752aedf7d71dcccb577ed518e9fd

SHA256
33c4d06c91166db9ece6e6ad6b9fa1344316f995f7db268bf1b7f9c08ed3e6fb

SHA512
ca7ca581c8d8d67f43e7858d7b4859fec1228fd1ba6e63711d508c1ab3477a071d40090fdae6ec0c8d1445e15fbb2fc60154e32e03f8398056388f1148f920de

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_lzma.pyd
MD5
5e7a6b749a05dd934ee4471411420053

SHA1
fcd1e54011b98928edbb3820a5838568b9573453

SHA256
4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

SHA512
ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_lzma.pyd
MD5
5e7a6b749a05dd934ee4471411420053

SHA1
fcd1e54011b98928edbb3820a5838568b9573453

SHA256
4dcd803319e24ba8c8e3d5ce2e02c209bd14a9ab07a540d6e3ae52f69d01e742

SHA512
ce4c5456308adbef0a9d44064aae67b2bb2a913881405ae2e69127eb7ab00a09882fa5304d80d5b3728942b0ab56d1c99132666b6c0ea8809a21396aeaadd8a2

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_socket.pyd
MD5
7c5c5e6e4ed888dd26c7aa063bb9f88e

SHA1
a7a3694739b27c3d34beb1a9730fc3dcbae6744a

SHA256
2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

SHA512
9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\_socket.pyd
MD5
7c5c5e6e4ed888dd26c7aa063bb9f88e

SHA1
a7a3694739b27c3d34beb1a9730fc3dcbae6744a

SHA256
2bb4e5d711fe521e2c9a80f04d2f745f58561dc35f169e06ea17aabf27d334fe

SHA512
9c49c3fe740464f649a0379bdc6bc474cce6a1331f87d2ba2ab489c4545ad7cb311c757af59e8174bb3c87af438a5d47621bd9b2b4750abe128d189d14d80065

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\gevent\libuv\_corecffi.cp37-win_amd64.pyd
MD5
5661a74845831bb9b81cdc507e0f15be

SHA1
a43e0cfb8c83e78379bb0e0df23735780f2643c8

SHA256
b0e30abbb55ca4be12178a1577db821d0d1d5bcadbdf0e989764d074a83a8860

SHA512
623f6cf5e0ba56101820a3e839e868a831a5d928aab2493e2c089e7e4bdd6ae13f8cc29ab33a2183eeff12f0c34cd92b4be59803b65b053961670fbebe346f34

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\libcrypto-1_1-x64.dll
MD5
8c75bca5ea3bea4d63f52369e3694d01

SHA1
a0c0fd3d9e5688d75386094979171dbde2ce583a

SHA256
8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

SHA512
6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\libcrypto-1_1-x64.dll
MD5
8c75bca5ea3bea4d63f52369e3694d01

SHA1
a0c0fd3d9e5688d75386094979171dbde2ce583a

SHA256
8513e629cd85a984e4a30dfe4b3b7502ab87c8bc920825c11035718cb0211ea0

SHA512
6d80d26d91b704d50ff3ad74f76d6b1afe98af3d7a18e43011dbe3809adc305b0e382c10868328eb82c9f8b4c77bca1522bdc023c7c8712057b65f6579c9dff5

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\pyexpat.pyd
MD5
a045432966523928d20b7dce4537c776

SHA1
0869868b4548ec7b0bddf7539b6022185bc3f6da

SHA256
d4ca4589c6c8ff5a9f71da2f63c1d214bfeb8662375b42ee201b7c9e07c586a6

SHA512
bdab5104b9cc278608cdc6662f38855c3a7c348d372034790c120209cbdf9730bbcece9dd1a59f8060d3dc29f5f193b988c9273b6eec5987bddc94cc28a9bc9b

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\pyexpat.pyd
MD5
a045432966523928d20b7dce4537c776

SHA1
0869868b4548ec7b0bddf7539b6022185bc3f6da

SHA256
d4ca4589c6c8ff5a9f71da2f63c1d214bfeb8662375b42ee201b7c9e07c586a6

SHA512
bdab5104b9cc278608cdc6662f38855c3a7c348d372034790c120209cbdf9730bbcece9dd1a59f8060d3dc29f5f193b988c9273b6eec5987bddc94cc28a9bc9b

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\select.pyd
MD5
1650617f3378c5bd469906ae1256a54c

SHA1
dd89ffd426b6820fd79631e4c99760cb485d3a67

SHA256
5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

SHA512
89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\lib\select.pyd
MD5
1650617f3378c5bd469906ae1256a54c

SHA1
dd89ffd426b6820fd79631e4c99760cb485d3a67

SHA256
5724cea789a2ebc148ce277ce042e27432603db2ec64e80b13d37bcb775aee98

SHA512
89ecbbf156e2be066c7d4e3e0ecd08c2704b6a796079517c91cf4aa6682040ba07460596aaddc5550c6ec588979dfec010fed4b87e049000caceed26e8f86ffe

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\python37.dll
MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\ZeroNet-win-dist-win64\python37.dll
MD5
28f9065753cc9436305485567ce894b0

SHA1
36ebb3188a787b63fb17bd01a847511c7b15e88e

SHA256
6f2f87b74aea483a0636fc5c480b294a8103b427a3daf450c1e237c2a2271b1a

SHA512
c3bbc50afb4a0b625aff28650befd126481018bd0b1b9a56c107e3792641679c7d1bfc8be6c9d0760fff6853f8f114b62490cd3567b06abc76ab7db3f244ab54

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
\Users\Admin\AppData\Roaming\ZeroNet Filesharing Tool\zeronet-downloader.exe
MD5
9e0722e16793b9e6ffd8b48f4033a236

SHA1
b76ebcc61e0d16a93feca87525966d0c4f571ec3

SHA256
b5782642408eb1aa19df1781e8de277e0f586f66632b3171069630651c11e988

SHA512
f12b277330eeac8e04d3d5b69b37c690897fc49c6586e4ec9c5aa412cd64c07fd9c4edfe6607d01fa49ec6efb3d594af6277555ce70cf0d970d1c29ef5f04bd9

Download Submit
memory/848-147-0x0000000000000000-mapping.dmp

Download
memory/1008-153-0x0000000000000000-mapping.dmp

Download
memory/1096-131-0x0000000000000000-mapping.dmp

Download
memory/1400-81-0x0000000000000000-mapping.dmp

Download
memory/1404-68-0x0000000000000000-mapping.dmp

Download
memory/1404-151-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/1444-152-0x0000000000000000-mapping.dmp

Download
memory/1496-75-0x0000000000000000-mapping.dmp

Download
memory/1500-133-0x0000000000000000-mapping.dmp

Download
memory/1516-149-0x0000000000000000-mapping.dmp

Download
memory/1564-148-0x0000000000000000-mapping.dmp

Download
memory/1572-132-0x0000000000000000-mapping.dmp

Download
memory/1576-138-0x0000000075550000-0x00000000755D2000-memory.dmp

Filesize
520KB

Download
memory/1576-142-0x0000000075600000-0x0000000075622000-memory.dmp

Filesize
136KB

Download
memory/1576-136-0x0000000076A01000-0x0000000076A03000-memory.dmp

Filesize
8KB

Download
memory/1576-139-0x00000000751A0000-0x00000000753BE000-memory.dmp

Filesize
2.1MB

Download
memory/1576-140-0x0000000075110000-0x0000000075192000-memory.dmp

Filesize
520KB

Download
memory/1576-141-0x0000000000200000-0x000000000057F000-memory.dmp

Filesize
3.5MB

Download
memory/1576-143-0x0000000075550000-0x00000000755D2000-memory.dmp

Filesize
520KB

Download
memory/1576-145-0x0000000075110000-0x0000000075192000-memory.dmp

Filesize
520KB

Download
memory/1576-144-0x00000000751A0000-0x00000000753BE000-memory.dmp

Filesize
2.1MB

Download
memory/1576-137-0x0000000075600000-0x0000000075622000-memory.dmp

Filesize
136KB

Download
memory/1576-146-0x0000000000200000-0x000000000057F000-memory.dmp

Filesize
3.5MB

Download
memory/1576-135-0x0000000000000000-mapping.dmp

Download
memory/1732-134-0x0000000000000000-mapping.dmp

Download
memory/1812-130-0x0000000000000000-mapping.dmp

Download
memory/1820-150-0x0000000000000000-mapping.dmp

Download
memory/1944-129-0x0000000000000000-mapping.dmp

Download
memory/1972-59-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Filesize
8KB

Download
memory/1976-62-0x0000000000000000-mapping.dmp

Download
memory/2032-154-0x0000000000000000-mapping.dmp

Download