Overview

overview

10

Static

static

10

m1f1f3a069...5d.exe

windows7-x64

10

m1f1f3a069...5d.exe

windows10-1703-x64

10

m1f1f3a069...5d.exe

windows10-2004-x64

10

m1f1f3a069...5d.exe

windows11-21h2-x64

10

Resubmissions

10/04/2024, 02:28

240410-cyaxtsca4310

10/04/2024, 02:28

240410-cx45aaca3610

10/04/2024, 02:28

240410-cx4hrafc6110

10/04/2024, 02:28

240410-cx37zsfc6y10

14/10/2023, 01:16

231014-bm3ysshd6t10

Analysis

  • max time kernel
    1447s
  • max time network
    1801s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    m1f1f3a069223072f8d6802a079235d.exe
  • Size 306KB
  • Sample240410-cyaxtsca43
  • SHA256 c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot6209822134:AAHQxD-CI1YDVcNbXijXHlonsEUgv3dfYtg/sendMessage?chat_id=-1001529292045

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 26 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 50 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe
    "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1400
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:944
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3380
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:3092
        • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:1244
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp6AC0.tmp" -C "C:\Users\Admin\AppData\Local\d67800nkmj"
            4⤵
              PID:2488
            • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
              "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:2372
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2744
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1804
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2304
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:776
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:876
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4900
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2660
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:776
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:716
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3708
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2680
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2904
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3364
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:384
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4980
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4432
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3628
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:5068
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3032
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3936
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2792
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:712
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3472
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1200
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4668
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3212
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2336
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3708
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:832
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3768
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2588
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3312
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3292
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:568
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1776
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1344
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:840
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2748

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            m1f1f3a069223072f8d6802a079235d.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\m1f1f3a069223072f8d6802a079235d.exe.log
            • Size 847B
            • SHA256 169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
            • MD5 SHA1 SHA512
            Submit Download

            m1f1f3a069223072f8d6802a079235d.exe
            • Path C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
            • Size 306KB
            • SHA256 c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            tmp6AC0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp6AC0.tmp
            • Size 13.3MB
            • SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdesc-consensus.tmp
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdesc-consensus.tmp
            • Size 2.7MB
            • SHA256 60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            cached-microdescs.new
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdescs.new
            • Size 9.9MB
            • SHA256 77d0ff54b714d396f8fcb94f8cd06d13e090b462686507585f78af57748d297d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            hostname
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\host\hostname
            • Size 64B
            • SHA256 566a69d24f9d76dc6e954bf7f9c7b1edea96c00db9e9c7ebaff693e7c6bc4234
            • MD5 SHA1 SHA512
            Submit Download

            port.dat
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\port.dat
            • Size 4B
            • SHA256 88be096564d631b8b5f5cb8f329b13ef2337e10a588cd75dace81fb8f87aeca5
            • MD5 SHA1 SHA512
            Submit Download

            tor.exe
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
            • Size 7.4MB
            • SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            torrc.txt
            • Path C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt
            • Size 218B
            • SHA256 de1268f5fca064ada3b6b48c5f4558541bf036616639adca3029666055da0393
            • MD5 SHA1 SHA512
            Submit Download

            memory/712-250-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/712-252-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/716-133-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/716-131-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/840-333-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/876-102-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/876-105-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/876-103-0x000001BD6DA70000-0x000001BD6DA80000-memory.dmp
            Download

            memory/1064-155-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1064-157-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1188-141-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1188-139-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1200-262-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1200-264-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1244-73-0x000001556C450000-0x000001556C460000-memory.dmp
            Download

            memory/1244-68-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1244-11-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1244-12-0x000001556C450000-0x000001556C460000-memory.dmp
            Download

            memory/1776-331-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1776-329-0x0000019466CB0000-0x0000019466CC0000-memory.dmp
            Download

            memory/1776-328-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1880-212-0x000001F39FDD0000-0x000001F39FDE0000-memory.dmp
            Download

            memory/1880-214-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/1880-211-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/2304-96-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/2304-94-0x00000261F7370000-0x00000261F7380000-memory.dmp
            Download

            memory/2304-93-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/2744-76-0x000001FD576A0000-0x000001FD576B0000-memory.dmp
            Download

            memory/2744-79-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/2744-75-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3036-1-0x00007FFFEB4B0000-0x00007FFFEBF71000-memory.dmp
            Download

            memory/3036-4-0x000001ECF9230000-0x000001ECF9240000-memory.dmp
            Download

            memory/3036-6-0x00007FFFEB4B0000-0x00007FFFEBF71000-memory.dmp
            Download

            memory/3036-0-0x000001ECF6D10000-0x000001ECF6D62000-memory.dmp
            Download

            memory/3212-276-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3212-274-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3312-303-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3312-305-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3344-201-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3344-199-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3708-280-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3708-278-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3768-297-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3768-294-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3768-295-0x0000023F6B0C0000-0x0000023F6B0D0000-memory.dmp
            Download

            memory/3936-240-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3936-238-0x0000019B7ACF0000-0x0000019B7AD00000-memory.dmp
            Download

            memory/3936-237-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3960-121-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/3960-119-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4004-107-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4004-109-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4112-224-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4112-227-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4112-225-0x0000024FFA9B0000-0x0000024FFA9C0000-memory.dmp
            Download

            memory/4964-167-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4964-169-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4968-177-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4968-175-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4980-189-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/4980-187-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/5040-311-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download

            memory/5040-312-0x0000022EA3C40000-0x0000022EA3C50000-memory.dmp
            Download

            memory/5040-314-0x00007FFFEAB50000-0x00007FFFEB611000-memory.dmp
            Download