Overview

overview

10

Static

static

10

k2fef48209...18.exe

windows7-x64

10

k2fef48209...18.exe

windows10-1703-x64

10

k2fef48209...18.exe

windows10-2004-x64

10

k2fef48209...18.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:38

240410-c4pceacb24 10

10-04-2024 02:37

240410-c4ne4scb23 10

10-04-2024 02:37

240410-c4llhsca99 10

10-04-2024 02:37

240410-c4jf6aca98 10

14-10-2023 01:31

231014-bxezqahg8w 10

Analysis

  • max time kernel
    1199s
  • max time network
    1200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 02:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe

  • Size

    339KB

  • MD5

    1cab66a5c15f97f040fb23d354d04a9c

  • SHA1

    f0dbebd22b2c7bfedbefa4435b345c58416f9448

  • SHA256

    d71329c78c704ee9cc7133761b5e738a315e7eb784e348d7743a8a7366724e9f

  • SHA512

    a5508a75a0a7c747cc50fe8284b9097e1cb9ae83bd7e80553ffa875a6d07d6eec7fc18f66a0a328aa0614c26642d884bfe152e6c09a11eeb0d64f6be66064eab

  • SSDEEP

    3072:gdrpN/JlLKd5hkad0lk0vGJGMlngDBXrkhamyeFykt9sxc8eTRLUvenjLM/zNlgl:0UGPUvva+lxXY6uXAJMI9bAV0D

Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 22 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 42 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
    "C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "k2fef4820980d3c2c1f2cce2f95e94f5e1c18" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4216
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3796
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3432
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "k2fef4820980d3c2c1f2cce2f95e94f5e1c18" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1368
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4332
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp499C.tmp" -C "C:\Users\Admin\AppData\Local\lcybndk48g"
            4⤵
              PID:1160
            • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
              "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:652
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1644
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2752
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3156
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3692
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4136
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1672
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2764
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2908
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4484
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2684
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2144
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3080
      • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3480
        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4348
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:4804
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3836
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3644
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3512
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:216
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2940
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3592
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4828
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4364
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3020
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3144
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4300
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:972
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4812
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:740
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2356
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2836
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2908
        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
            "C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3064

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe.log
          Filesize

          847B

          MD5

          3308a84a40841fab7dfec198b3c31af7

          SHA1

          4e7ab6336c0538be5dd7da529c0265b3b6523083

          SHA256

          169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

          SHA512

          97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

          Download Submit

        • C:\Users\Admin\AppData\Local\TeamViewer\k2fef4820980d3c2c1f2cce2f95e94f5e1c18.exe
          Filesize

          339KB

          MD5

          1cab66a5c15f97f040fb23d354d04a9c

          SHA1

          f0dbebd22b2c7bfedbefa4435b345c58416f9448

          SHA256

          d71329c78c704ee9cc7133761b5e738a315e7eb784e348d7743a8a7366724e9f

          SHA512

          a5508a75a0a7c747cc50fe8284b9097e1cb9ae83bd7e80553ffa875a6d07d6eec7fc18f66a0a328aa0614c26642d884bfe152e6c09a11eeb0d64f6be66064eab

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmp499C.tmp
          Filesize

          13.3MB

          MD5

          89d2d5811c1aff539bb355f15f3ddad0

          SHA1

          5bb3577c25b6d323d927200c48cd184a3e27c873

          SHA256

          b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

          SHA512

          39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\data\cached-microdesc-consensus.tmp
          Filesize

          2.7MB

          MD5

          a0db8a87f7b723266c8b04255da46b06

          SHA1

          4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

          SHA256

          60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

          SHA512

          41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\data\cached-microdescs.new
          Filesize

          8.3MB

          MD5

          aa0f1d098d38f1ad1d340c9fdb6a438f

          SHA1

          2ea0d3a6dd0854edcb28e72bdb56cebfe13734c6

          SHA256

          6d9502a0dffaa98a6fc2e74f04d5e831da446557c161c22dd0a647468dd6595e

          SHA512

          fd7da8ddbc924f75f02d511796d6530e66a378645004cc3d1503a4b7ac5043e61c0d3eb50ef0deebddb96d3a32e94c04298fae70af9b6ff9a79236c3b29f1e9a

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\host\hostname
          Filesize

          64B

          MD5

          b8b67ae8969c51f3d753b31ff7df40e6

          SHA1

          264e50e5128ac1edc0a0514c79fd3ff1a0e66b30

          SHA256

          4deb5a0e65c557d9f6b78ab0d13cf53e18d09d933eaac73a4c69ff2070c20f50

          SHA512

          8ed742be1aab8535fef0cfe6c67b2d628d794dcf5aabd4e0ac291ce69721474bb301e8e511b66fc7eb75333ba9e83624f8455a19e1cd4a8f40114f6393f39d43

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\port.dat
          Filesize

          4B

          MD5

          6097d8f3714205740f30debe1166744e

          SHA1

          2d5d5e7caf98485e652d0f1227602e440990f9fd

          SHA256

          9943324cb3f1a48a2963633905d35b97c3a24eb4b8ee84aafaef348ec3490799

          SHA512

          06bd756564937521ba089bd7893e7b372a81e170ed0b1120708d8235d279a241d0628b01a68ede30689e47875368c26df52360f7b9e9a994eedd6c487404c1db

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\tor\tor.exe
          Filesize

          7.4MB

          MD5

          88590909765350c0d70c6c34b1f31dd2

          SHA1

          129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

          SHA256

          46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

          SHA512

          a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          Download Submit

        • C:\Users\Admin\AppData\Local\lcybndk48g\torrc.txt
          Filesize

          218B

          MD5

          88aa10b558579ded8c6566656577498b

          SHA1

          121d55f44d38b8bc26308b4d1779ba68d0316d77

          SHA256

          ad47003ade53baa1a6a31bdac90f7de389f5f9f52890e3072e37ec7c59537159

          SHA512

          b0714f9ef3838b8070ebf6822d4978a1f8bebc1c1efc30ec88849a1d63125fee00391dcad92d2d6a61f59350061228a590eef7ddaff2f724dab72259f2154fca

          Download Submit

        • memory/740-323-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/740-325-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/972-317-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/972-315-0x0000016C6D350000-0x0000016C6D360000-memory.dmp

          Filesize

          64KB

          Download

        • memory/972-314-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1644-60-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1644-63-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1648-252-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1648-249-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1648-250-0x000001E7DD730000-0x000001E7DD740000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2004-298-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2004-300-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2144-141-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2144-139-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2740-97-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2740-98-0x0000025FBB940000-0x0000025FBB950000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2740-100-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2764-111-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2764-113-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2836-337-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2836-335-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3020-286-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3020-288-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3052-125-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3052-123-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3480-151-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3480-153-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3480-243-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3480-241-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3592-266-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3592-268-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3644-232-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3644-234-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3836-195-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-178-0x00000132D1780000-0x00000132D1790000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3836-199-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-200-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-201-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-202-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-203-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-204-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-205-0x00000132D99C0000-0x00000132D99C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-206-0x00000132D99B0000-0x00000132D99B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-208-0x00000132D99C0000-0x00000132D99C1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-211-0x00000132D99B0000-0x00000132D99B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-214-0x00000132D98F0000-0x00000132D98F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-226-0x00000132D9AF0000-0x00000132D9AF1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-228-0x00000132D9B00000-0x00000132D9B01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-230-0x00000132D9C10000-0x00000132D9C11000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-229-0x00000132D9B00000-0x00000132D9B01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-197-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-196-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-198-0x00000132D9D90000-0x00000132D9D91000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3836-194-0x00000132D9D70000-0x00000132D9D71000-memory.dmp

          Filesize

          4KB

          Download

        • memory/4136-109-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4136-107-0x00000155B6C90000-0x00000155B6CA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4136-106-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4332-11-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4332-58-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4332-12-0x00000197E4040000-0x00000197E4050000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4332-59-0x00000197E4040000-0x00000197E4050000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4336-137-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4336-135-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4364-1-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4364-6-0x00007FF8665B0000-0x00007FF867071000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4364-4-0x00000175A3ED0000-0x00000175A3EE0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4364-0-0x00000175A2220000-0x00000175A227C000-memory.dmp

          Filesize

          368KB

          Download

        • memory/4432-278-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4432-280-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4852-343-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4852-345-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4940-88-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4940-89-0x0000022175D20000-0x0000022175D30000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4940-91-0x00007FF8653E0000-0x00007FF865EA1000-memory.dmp

          Filesize

          10.8MB

          Download