Overview

overview

10

Static

static

10

qsteemp.exe

windows7-x64

10

qsteemp.exe

windows10-1703-x64

10

qsteemp.exe

windows10-2004-x64

10

qsteemp.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:17

240410-cqs4fafc2v 10

10-04-2024 02:17

240410-cqsgxabh56 10

10-04-2024 02:17

240410-cqrwdabh54 10

10-04-2024 02:17

240410-cqrklsbh53 10

13-05-2023 22:56

230513-2wtplahg95 10

Analysis

  • max time kernel
    1798s
  • max time network
    1807s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10-04-2024 02:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    qsteemp.exe

  • Size

    165KB

  • MD5

    90cd3202af31b431dcc5e47cf3b8c0d7

  • SHA1

    747f68fb8f122241059c219eeeeadac61e8215be

  • SHA256

    e76e206e8ae24f95a329b4f6ecdf1f22b76b07a8c628c0619b781bdba2d85732

  • SHA512

    b1025ca0dfa86cd6649337bfc6b555a9101fce38955566424955a6fe07782bea41eeaf4f233946eb6be5756b23398129bad98a87c6b07478f787df8bf3235481

  • SSDEEP

    3072:fV6h5WXwyNUD44ykiQbGjlc/SGvjQtbGTl2MRMc:9AuwMPkhbGRc/T6A

Score
10/10
gurcuspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6209822134:AAHQxD-CI1YDVcNbXijXHlonsEUgv3dfYtg/sendMessage?chat_id=-1001529292045

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Executes dropped EXE 60 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\qsteemp.exe
    "C:\Users\Admin\AppData\Local\Temp\qsteemp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "qsteemp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\qsteemp.exe" &&START "" "C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3188
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2888
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "qsteemp" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:4460
        • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
          "C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpB016.tmp" -C "C:\Users\Admin\AppData\Local\6kfrvwd31o"
            4⤵
              PID:1916
            • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
              "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:2968
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4660
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1184
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4576
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:748
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4696
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3688
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4852
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3840
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1848
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:224
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2796
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:644
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1412
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3696
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2936
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5088
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2740
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4796
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3996
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:252
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3692
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3912
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4908
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2112
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3192
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1652
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2452
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4772
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2720
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4008
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:984
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4136
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2792
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1916
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4412
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4168
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2872
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2848
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:468
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4048
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4060
      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:572
        • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
          "C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4708

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\data\cached-certs
        Filesize

        18KB

        MD5

        5f5b9a541f1865aa1ac3aa4d4a0581f1

        SHA1

        bbb456d9e04927bc2d69d5727997e85a01756f5b

        SHA256

        3ad897526c2fc53ae26fea7d61ae3ea8b9bd3c69bd88394271c488b1e9a63686

        SHA512

        229190a22951470ff2f8cbb23e41e654d80c6b4367db3b0f9541bac90a46431908a6143dd1a774d4ec4fd710bdec55a031c67e8c373c00e8ded5edd59560325a

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\data\cached-microdesc-consensus
        Filesize

        2.7MB

        MD5

        814f8cba43d923834b0d0027591e52bf

        SHA1

        2814b4faa0221b252164fbf9586051c07faa050f

        SHA256

        406d96a4788b07a0c4bda0e289d04472bc92a13f3b5b51e7478d095986735597

        SHA512

        45d866ec699d731eb7a50669bfa2fb469652b92d92b4546d373777192bff9d2201095ec9e13079ff422b4a7a15175142aa7d2abb57aaf4262b3e837340677069

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\data\cached-microdescs.new
        Filesize

        7.0MB

        MD5

        f82293970efa60123f34c2e575ad878b

        SHA1

        9c8d64989c375e70980b42433d34b9c7af1a4bc9

        SHA256

        af5859cd8a839b9d40c00454bc05b62209ebce054615709f9f94e80b8a4615dd

        SHA512

        63ab79b37b6ffaa30dc4b2733a9202e0a65ec3bde647ca9c4ccf59d4b9d93d471742ba79f195b5fdff5a80c7c2085947509c3af98884fef7a952fad4d5205813

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\host\hostname
        Filesize

        64B

        MD5

        aff04321233fa245206f3044b49d8332

        SHA1

        ffa08418b9467f7e69d842dbd8af974ac5d0233a

        SHA256

        a46d77f5344c00bab1b88465a7ca7c3b323d6c0c8efe9876860fd079e6fb0018

        SHA512

        e13a428ec585d3c352406b79525941d71b6a659130e7958f14f977173e68433f0b727051875fa1c2d5321ef4846722dd72d91c7cc73445fba10848a54927b59d

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\port.dat
        Filesize

        4B

        MD5

        7cc532d783a7461f227a5da8ea80bfe1

        SHA1

        f7df8cb47630b8cd7eb73d0da7a23b9c01aaaa84

        SHA256

        0d2625cc8c9515a19bd1e6fc5afa3e3922ac5b12c11c42ca2b760fe442261e50

        SHA512

        0eb822e42d43d64ed73337c3d88651b10c095c15123efa9656332eefdd54e461017ad42109380e10661906208ea03c50b083dd84f15d605467ea1e45d12bd045

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\6kfrvwd31o\torrc.txt
        Filesize

        218B

        MD5

        c09eb9bfeb219ec0bff8b7ac3ac830ff

        SHA1

        8242bcbbdfcc51ee920ef4d65f89e302778232f7

        SHA256

        b4247b6728b8c5e588066f864e9a9867d756c2776eb1fc4bcbc9d4fcab4fb5e4

        SHA512

        18f6bc607fd0b3ea231f560c160ed25c441defeb224dc390a981c597760492650d822ac87b7e6839761446d398ba46594417df8581386d3f8cde9c12e277714f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\qsteemp.exe.log
        Filesize

        1KB

        MD5

        081b644082c51f2ff0f00087877003b5

        SHA1

        2eeb0a8a592e5327873f5a6704031c1ff6d0bd31

        SHA256

        cc427c714517dd0a3c96354869ce1bb300bf4935006fc628ceb28e2f040197ac

        SHA512

        95621587e55a5f5111aea05cadbaf56429adde2de0c41c9de8e74c03d31116edf72b63d76f65af45e4b14b68fe214926425581f77113d332eb91b0b6a5598eff

        Download Submit

      • C:\Users\Admin\AppData\Local\NET.Framework\qsteemp.exe
        Filesize

        165KB

        MD5

        90cd3202af31b431dcc5e47cf3b8c0d7

        SHA1

        747f68fb8f122241059c219eeeeadac61e8215be

        SHA256

        e76e206e8ae24f95a329b4f6ecdf1f22b76b07a8c628c0619b781bdba2d85732

        SHA512

        b1025ca0dfa86cd6649337bfc6b555a9101fce38955566424955a6fe07782bea41eeaf4f233946eb6be5756b23398129bad98a87c6b07478f787df8bf3235481

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpB016.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • memory/224-133-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/224-131-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/644-147-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/644-148-0x0000017478980000-0x0000017478990000-memory.dmp

        Filesize

        64KB

        Download

      • memory/644-150-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/748-105-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/748-102-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/748-103-0x00000204F27B0000-0x00000204F27C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1052-284-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1052-286-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1260-222-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1260-220-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1452-230-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1452-228-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1568-190-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1568-184-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1916-335-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1916-333-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2188-2-0x0000027CDD890000-0x0000027CDD8A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2188-6-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2188-0-0x0000027CDD440000-0x0000027CDD470000-memory.dmp

        Filesize

        192KB

        Download

      • memory/2188-1-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2432-166-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2432-164-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2848-206-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2848-204-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3192-254-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3192-252-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3392-321-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3392-323-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3508-278-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3508-98-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3508-100-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3508-276-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3688-115-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3688-117-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3840-129-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3840-127-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3996-196-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/3996-198-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4008-296-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4008-298-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4164-96-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4164-93-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4164-94-0x00000222ABFE0000-0x00000222ABFF0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4168-345-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4184-79-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4184-80-0x0000020728890000-0x00000207288A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4184-83-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4548-11-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4548-12-0x000002057C560000-0x000002057C570000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4548-52-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4548-63-0x000002057C560000-0x000002057C570000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4604-240-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4604-242-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4624-266-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4624-264-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4640-311-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4640-309-0x000001DCE9AD0000-0x000001DCE9AE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4640-308-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4884-156-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4884-158-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5088-172-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5088-178-0x00007FFED9AB0000-0x00007FFEDA572000-memory.dmp

        Filesize

        10.8MB

        Download