Overview

overview

10

Static

static

10

Xd2c386a3a...9a.exe

windows7-x64

10

Xd2c386a3a...9a.exe

windows10-1703-x64

10

Xd2c386a3a...9a.exe

windows10-2004-x64

10

Xd2c386a3a...9a.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:25

240410-cwlljsbh99 10

10-04-2024 02:25

240410-cwlasafc5v 10

10-04-2024 02:25

240410-cwkn9afc5t 10

10-04-2024 02:25

240410-cwkdgsfc5s 10

14-10-2023 04:25

231014-e12vfagc2y 10

Analysis

  • max time kernel
    1198s
  • max time network
    1202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

  • Size

    289KB

  • MD5

    88cfc2ccc0575567122d1d233f9eb1c3

  • SHA1

    4be67d0d801197f88c14d62f4495f17e89fc471f

  • SHA256

    41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

  • SHA512

    a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

  • SSDEEP

    6144:uHClm6SWPoK5Z0EwVSmRPQp+L5v9bbSUpi:uHCnZxb8hLLSUpi

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6176004110:AAFKA5be4dMwA848HWxzYIzrzzOGIHMOJGc/sendMessage?chat_id=615133582

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 22 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 42 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
    "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4756
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:620
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2180
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1056
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4668
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp687E.tmp" -C "C:\Users\Admin\AppData\Local\xdh16uwiax"
            4⤵
              PID:4660
            • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
              "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:4056
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4200
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:220
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3784
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3216
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:4680
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1396
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1720
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:876
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1692
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:468
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1780
      • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:876
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:2244
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2176
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2092
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1936
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4960
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3492
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4652
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:4852
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2808
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:3624
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:1096
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2920
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2076
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2536
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:180
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2660
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3752
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2148
        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          1⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1668
          • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
            "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
            2⤵
            • Executes dropped EXE
            PID:2232

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe.log
          Filesize

          847B

          MD5

          3308a84a40841fab7dfec198b3c31af7

          SHA1

          4e7ab6336c0538be5dd7da529c0265b3b6523083

          SHA256

          169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

          SHA512

          97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

          Download Submit

        • C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
          Filesize

          289KB

          MD5

          88cfc2ccc0575567122d1d233f9eb1c3

          SHA1

          4be67d0d801197f88c14d62f4495f17e89fc471f

          SHA256

          41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

          SHA512

          a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmp687E.tmp
          Filesize

          13.3MB

          MD5

          89d2d5811c1aff539bb355f15f3ddad0

          SHA1

          5bb3577c25b6d323d927200c48cd184a3e27c873

          SHA256

          b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

          SHA512

          39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdesc-consensus.tmp
          Filesize

          2.7MB

          MD5

          a0db8a87f7b723266c8b04255da46b06

          SHA1

          4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

          SHA256

          60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

          SHA512

          41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdescs.new
          Filesize

          12.5MB

          MD5

          1921bb69fd746b314a61c8dd42b6a490

          SHA1

          b1bf93210447f509b238c67ed5302fd8e42f2735

          SHA256

          0999688498efec4c0cecc399abc24058dc4371b7a4045dec09330173005a7f09

          SHA512

          9e89a0fef09a3f32ea396d025fcc4003d567a66aab91fda1edcd82601f9d20704292f17ec7cd4d86825f465e0d68758777e5aed76a5e95fc8ae9442d90eb18c4

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\host\hostname
          Filesize

          64B

          MD5

          30461f47cb560738daa945031d4025fb

          SHA1

          f26614bbec57b1b597b720126813f37fa826f6cf

          SHA256

          3e0e7392213e61f19bbd4b0c45e9ea615cbcb34160268979ce42597ca01ac0bd

          SHA512

          29e386205bb4069777dfe42e6f75885d39a4abfeca50cecb2d965e893dabca0f1e0d0ede929ae08d3d78807e3e4cca042caa9fc17bfd5425dc639f46108a80b4

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\port.dat
          Filesize

          4B

          MD5

          f8037f94e53f17a2cc301033ca86d278

          SHA1

          c477daaf6618c98efb953d559c9efa6c015f58a6

          SHA256

          5b23e77bcbfd48044a8bd56f7689fc325f309690072fe25a5dfe11af0062a130

          SHA512

          633d2e8f4a275ad7aec9282c5ca4e2122d4396fb1868f21147a2864da90661ca3cad33b421cdc6acba20584c401540416fbb3a7cfd52d07d399af191bdc24941

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
          Filesize

          7.4MB

          MD5

          88590909765350c0d70c6c34b1f31dd2

          SHA1

          129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

          SHA256

          46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

          SHA512

          a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

          Download Submit

        • C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt
          Filesize

          218B

          MD5

          1ad8b1c407f4a62d1b82db1bf61640ab

          SHA1

          8ed511fff4742b4a99f8a668fd66580fa35e4d42

          SHA256

          49f95974c7ef34f5a2e12f822b96d4e407b9f3def610cb946115f9bb329066f7

          SHA512

          ff2afcb7eeb9c5b953dc7031a3a89a24a271c5ebe97a0ee211eeebe4a370e4d4e1e1683903a363804458aebecfb898c5794a1223cffc3a1b863493204c173efc

          Download Submit

        • memory/180-311-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/180-313-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1056-119-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1056-120-0x000001D9245F0000-0x000001D924600000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1056-122-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1396-229-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1396-227-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1668-331-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1668-334-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1668-332-0x000002D179F60000-0x000002D179F70000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1860-159-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/1860-157-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2076-299-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2076-301-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2112-214-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2112-216-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2112-139-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2112-137-0x000001921D6E0000-0x000001921D6F0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2112-136-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2132-145-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2132-147-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2176-211-0x0000016E6EF80000-0x0000016E6EF81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2176-210-0x0000016E6EF80000-0x0000016E6EF81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2176-208-0x0000016E6EF50000-0x0000016E6EF51000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2176-212-0x0000016E6F090000-0x0000016E6F091000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2176-192-0x0000016E66C40000-0x0000016E66C50000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2176-176-0x0000016E66B40000-0x0000016E66B50000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2808-263-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2808-265-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2844-291-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2844-293-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3752-319-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3752-321-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3784-81-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3784-82-0x00000228CD5E0000-0x00000228CD5F0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/3784-84-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4200-52-0x0000018E78580000-0x0000018E78590000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4200-50-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4200-59-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4312-107-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4312-109-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4508-275-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4508-277-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4652-251-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4652-253-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4668-51-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4668-65-0x000001D8E9D90000-0x000001D8E9DA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4668-11-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4668-12-0x000001D8E9D90000-0x000001D8E9DA0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4680-95-0x0000028F3F330000-0x0000028F3F340000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4680-94-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4680-97-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4824-171-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4824-169-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4948-0-0x00000212033A0000-0x00000212033EE000-memory.dmp

          Filesize

          312KB

          Download

        • memory/4948-6-0x00007FF943FE0000-0x00007FF944AA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4948-2-0x00000212050D0000-0x00000212050E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4948-1-0x00007FF943FE0000-0x00007FF944AA1000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4960-241-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/4960-239-0x00007FF942780000-0x00007FF943241000-memory.dmp

          Filesize

          10.8MB

          Download