Overview

overview

10

Static

static

3

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows10-2004-x64

10

75bff99bec...45.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:54

240417-r96wzada86 10

17-04-2024 14:54

240417-r95znsee4v 10

17-04-2024 14:54

240417-r943dada82 10

17-04-2024 14:54

240417-r9353sda77 10

17-04-2024 14:54

240417-r93jjsee3x 10

15-04-2024 13:19

240415-qkln3afc75 10

10-04-2024 12:02

240410-n7v5xaeh49 10

10-04-2024 12:02

240410-n7vjdaaa8t 10

Analysis

  • max time kernel
    1201s
  • max time network
    1210s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10-04-2024 12:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75bff99becc32bcbe56efbe7a75f4d45.exe

  • Size

    7.0MB

  • MD5

    75bff99becc32bcbe56efbe7a75f4d45

  • SHA1

    81bfcc77809161a5254a27d3d4d30548c96fcd5b

  • SHA256

    8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2

  • SHA512

    940af628585713a16e685eb5251c0b954bc014460cd4ca33226df2ef260f32af56223eaf1c341862fdf1669c6bafb6e7d9c5efbeb5e437ce5e2fd9905beece69

  • SSDEEP

    49152:uW/1GYdVTXN3r3+LXDIDAKpvuh3jwLN6/VNUKIdI9OiKuDbD2yvAkdm5wrgWX+5z:hXkZL/p

Score
10/10
bitratzgratpersistencerattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80

Attributes
  • communication_password

    d93b4f1ee6f5b875a4f7fcef966bd09a

  • tor_process

    WinSock

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 54 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 20 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
    "C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4084
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1648
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4288
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4208
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:428
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:204
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2308
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1612
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:220
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3012
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3016
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4844
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3280
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3384
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4668
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4408
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2880
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3712
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3016
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1252
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4676
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4280
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4584
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4880
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4168
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4980
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4176
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2240
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1252
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3532
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3148
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4680
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1028
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4656
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4728
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4100
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4976
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4244
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2672
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4592
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1520
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4600
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3508
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2788
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3080
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1904
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4580
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1060
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:2840
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4592
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:3436
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4528
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1756
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:4152
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
        • Executes dropped EXE
        PID:1280
      • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
        "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
        3⤵
          PID:2660

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
      Filesize

      973KB

      MD5

      5cfe61ff895c7daa889708665ef05d7b

      SHA1

      5e58efe30406243fbd58d4968b0492ddeef145f2

      SHA256

      f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

      SHA512

      43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
      Filesize

      20KB

      MD5

      7526f91e251a6b8cf0b9b070311d4608

      SHA1

      0420533314c308b777b82df5452df48e0c7571a0

      SHA256

      28c8428294fb87f342feafae7cd48817db3cf7edd61246075e9d02cf94a27897

      SHA512

      a9cf519f330dcfea7d09c967a892306d0805dee6856eb46fb8fc69c48586ceeeeb717ec107d36b75dc055a8a1b178eb488fedd7d985e5ade5fd1ee9f0ea10f56

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdesc-consensus.tmp
      Filesize

      2.6MB

      MD5

      6fcc4b924d58bbb8462b7ee1961c7977

      SHA1

      41e1e2d4561bb169144e7d1a08c6a7f3dc731c2d

      SHA256

      edbc99c46f9d6785d0cedf6fa6de99e6c7a20187a738e29d55258584db2660ed

      SHA512

      2d3539570f1a6024c291c25a3aed2f61668ec03aa614b92118380a60510fab72878539f0bc3d51e1c8ce20f3b26400c35cd714fcf146dd3288a8da861ee5a6fe

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs
      Filesize

      20.3MB

      MD5

      feebbcba8dab69143da85afc76d3df06

      SHA1

      448f4af0603483e0c56ac0303b6e58a33de51181

      SHA256

      d36c451559ebc0c27f4ee87ad1cac0af68709e2429eb972a9db8bb6b23ffa427

      SHA512

      7615d20bb112314ccba3bf3a12ee966a2f1fae2a96252783ab067e0775546780ed52b18f3b85f04241656c333b6d528e6fb9560f31b654d12a78db67ca186dbc

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
      Filesize

      9.6MB

      MD5

      8fe619058b43294563e6d8aa0b88616e

      SHA1

      e269347747f09ff8d918c26fb1aea71fa1b45a3c

      SHA256

      b905205e904920578e2cd661c349b7fb89e4d2d06bc171fc1d7446b072eff378

      SHA512

      dca67c6b7abe450c32b59e0a151d13591617a26f18fddb5b599a104bcb685ff0480cdd1d2cb13bc989af90e97b76e9469627b9679172b7a584bf2ba2d0906b1d

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
      Filesize

      20.3MB

      MD5

      4a03fa0ab2c2f71e4ffd3ee0dc1f647c

      SHA1

      2f6e6a0a12102d399cc43fcaee1a502eb1cae282

      SHA256

      f51be5bdc0c5afa0b6a02e26fcb0398786736a66eef04ee5a479599537449a39

      SHA512

      32e978965bb0a5cd75e971ff9427b35911396f653e0ec16cf3f74c28af08ff51172723df4307db6f704264952394dfaa58aafc871ed259f172f2b8cb9fbda711

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
      Filesize

      232B

      MD5

      cfc02c6966fc14b1f0036d4f90cd34b1

      SHA1

      2592f1ae846ef1c49fb8180f0bba75684c822eb5

      SHA256

      ba357eb3e5b7eaaf9dcea9f90a98494b89b35250fb7ad76fd4a9fe6bb0d6ecfa

      SHA512

      da35b2675f3ef61dbd1ac2acb9d9a774f1eb1600b128cc1f4f06f4bcf63902fed67badb7253cbb27f8047fdd479826186c1af0ad687319a6cbe8511678020238

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
      Filesize

      3KB

      MD5

      ad2bbc75e78ca40602b2284f9e9363d9

      SHA1

      e6ddc1b021349f98ab542ebe398508550e1a2b02

      SHA256

      ce13e3178d7d5193160d87758fa8ad69fc755ef93ff2626980aea5eaab9b6628

      SHA512

      eaa1fa0d7e1f7d966c2ab262ccdd600ff34dd610a63650e523969d83438f0f86a31f96be956380fb6919dcf3fc08016734a61af79aa49df0185124912243d420

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libcrypto-1_1.dll
      Filesize

      1.7MB

      MD5

      2384a02c4a1f7ec481adde3a020607d3

      SHA1

      7e848d35a10bf9296c8fa41956a3daa777f86365

      SHA256

      c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

      SHA512

      1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libgcc_s_sjlj-1.dll
      Filesize

      286KB

      MD5

      b0d98f7157d972190fe0759d4368d320

      SHA1

      5715a533621a2b642aad9616e603c6907d80efc4

      SHA256

      2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

      SHA512

      41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssp-0.dll
      Filesize

      88KB

      MD5

      2c916456f503075f746c6ea649cf9539

      SHA1

      fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

      SHA256

      cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

      SHA512

      1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\torrc
      Filesize

      157B

      MD5

      68afdef35a6105c2b148649bd05901b0

      SHA1

      828a2b590a95c2a411cc1b0004207747f2571024

      SHA256

      4e4e4e7f9fb03bcb898ce4f6075e3082d3a341d9fff1955ddf45089f83565622

      SHA512

      f198da05ec57c8525e6643f7f2c212701d0ab641d2850a28ce4cea7c33ac7b5c75782273bf7f01f95ccf02e27adf7c237ed116c5b0f220c13e70fe0aa7cfc671

      Download Submit
    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\zlib1.dll
      Filesize

      52KB

      MD5

      add33041af894b67fe34e1dc819b7eb6

      SHA1

      6db46eb021855a587c95479422adcc774a272eeb

      SHA256

      8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

      SHA512

      bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

      Download Submit
    • \Users\Admin\AppData\Local\d4f7be4f\tor\libevent-2-1-6.dll
      Filesize

      366KB

      MD5

      099983c13bade9554a3c17484e5481f1

      SHA1

      a84e69ad9722f999252d59d0ed9a99901a60e564

      SHA256

      b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

      SHA512

      89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

      Download Submit
    • \Users\Admin\AppData\Local\d4f7be4f\tor\libssl-1_1.dll
      Filesize

      439KB

      MD5

      c88826ac4bb879622e43ead5bdb95aeb

      SHA1

      87d29853649a86f0463bfd9ad887b85eedc21723

      SHA256

      c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

      SHA512

      f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

      Download Submit
    • \Users\Admin\AppData\Local\d4f7be4f\tor\libwinpthread-1.dll
      Filesize

      188KB

      MD5

      d407cc6d79a08039a6f4b50539e560b8

      SHA1

      21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

      SHA256

      92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

      SHA512

      378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

      Download Submit
    • memory/428-2684-0x0000000073B10000-0x0000000073DDF000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/428-2688-0x0000000073A40000-0x0000000073B08000-memory.dmp
      Filesize

      800KB

      Download
    • memory/428-2690-0x00000000736D0000-0x000000007379E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/428-2693-0x00000000742E0000-0x0000000074329000-memory.dmp
      Filesize

      292KB

      Download
    • memory/1648-2481-0x0000000073340000-0x000000007344A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1648-2520-0x0000000000E00000-0x0000000000E88000-memory.dmp
      Filesize

      544KB

      Download
    • memory/1648-2478-0x0000000001340000-0x000000000160F000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/1648-2475-0x00000000737A0000-0x0000000073868000-memory.dmp
      Filesize

      800KB

      Download
    • memory/1648-2477-0x0000000073720000-0x0000000073744000-memory.dmp
      Filesize

      144KB

      Download
    • memory/1648-2476-0x0000000073750000-0x0000000073799000-memory.dmp
      Filesize

      292KB

      Download
    • memory/1648-2474-0x0000000073870000-0x000000007393E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/1648-2461-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/1648-2584-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/1648-2482-0x00000000732B0000-0x0000000073338000-memory.dmp
      Filesize

      544KB

      Download
    • memory/1648-2485-0x0000000000E00000-0x0000000000E88000-memory.dmp
      Filesize

      544KB

      Download
    • memory/1648-2479-0x0000000073450000-0x000000007371F000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/1648-2519-0x0000000073450000-0x000000007371F000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/1648-2518-0x0000000001340000-0x000000000160F000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/1648-2513-0x0000000073870000-0x000000007393E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/1648-2517-0x00000000737A0000-0x0000000073868000-memory.dmp
      Filesize

      800KB

      Download
    • memory/1648-2510-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4084-2501-0x0000000000400000-0x0000000000BD8000-memory.dmp
      Filesize

      7.8MB

      Download
    • memory/4084-2492-0x0000000072FE0000-0x000000007301A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/4084-2441-0x0000000000400000-0x0000000000BD8000-memory.dmp
      Filesize

      7.8MB

      Download
    • memory/4084-2443-0x00000000742F0000-0x000000007432A000-memory.dmp
      Filesize

      232KB

      Download
    • memory/4084-2635-0x0000000073480000-0x00000000734BA000-memory.dmp
      Filesize

      232KB

      Download
    • memory/4208-2633-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4208-2610-0x00000000742B0000-0x00000000742D4000-memory.dmp
      Filesize

      144KB

      Download
    • memory/4208-2612-0x00000000736D0000-0x000000007379E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/4208-2634-0x0000000073A40000-0x0000000073B08000-memory.dmp
      Filesize

      800KB

      Download
    • memory/4208-2636-0x00000000742E0000-0x0000000074329000-memory.dmp
      Filesize

      292KB

      Download
    • memory/4208-2600-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4208-2637-0x0000000073830000-0x000000007393A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4208-2638-0x00000000737A0000-0x0000000073828000-memory.dmp
      Filesize

      544KB

      Download
    • memory/4208-2647-0x0000000073B10000-0x0000000073DDF000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/4208-2648-0x00000000742B0000-0x00000000742D4000-memory.dmp
      Filesize

      144KB

      Download
    • memory/4208-2649-0x00000000736D0000-0x000000007379E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/4208-2692-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4208-2606-0x00000000742E0000-0x0000000074329000-memory.dmp
      Filesize

      292KB

      Download
    • memory/4208-2607-0x0000000073830000-0x000000007393A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4208-2608-0x00000000737A0000-0x0000000073828000-memory.dmp
      Filesize

      544KB

      Download
    • memory/4208-2609-0x0000000073B10000-0x0000000073DDF000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/4208-2602-0x0000000073A40000-0x0000000073B08000-memory.dmp
      Filesize

      800KB

      Download
    • memory/4288-2591-0x0000000073870000-0x000000007393E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/4288-2567-0x00000000737A0000-0x0000000073868000-memory.dmp
      Filesize

      800KB

      Download
    • memory/4288-2593-0x0000000000F30000-0x0000000001334000-memory.dmp
      Filesize

      4.0MB

      Download
    • memory/4288-2592-0x0000000073720000-0x0000000073744000-memory.dmp
      Filesize

      144KB

      Download
    • memory/4288-2590-0x00000000737A0000-0x0000000073868000-memory.dmp
      Filesize

      800KB

      Download
    • memory/4288-2580-0x0000000073450000-0x000000007371F000-memory.dmp
      Filesize

      2.8MB

      Download
    • memory/4288-2577-0x00000000732B0000-0x0000000073338000-memory.dmp
      Filesize

      544KB

      Download
    • memory/4288-2576-0x0000000073340000-0x000000007344A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4288-2571-0x0000000073750000-0x0000000073799000-memory.dmp
      Filesize

      292KB

      Download
    • memory/4288-2573-0x0000000073720000-0x0000000073744000-memory.dmp
      Filesize

      144KB

      Download
    • memory/4288-2569-0x0000000073870000-0x000000007393E000-memory.dmp
      Filesize

      824KB

      Download
    • memory/4620-44-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-34-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-50-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-48-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-54-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-56-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-58-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-60-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-62-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-66-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-64-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-46-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-70-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-68-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-1-0x0000000000C90000-0x0000000001398000-memory.dmp
      Filesize

      7.0MB

      Download
    • memory/4620-72-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-2440-0x0000000073F00000-0x00000000745EE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/4620-42-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-40-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-38-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-36-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-52-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-32-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-30-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-28-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-26-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-24-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-22-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-20-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-18-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-16-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-14-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-12-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-9-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-10-0x0000000003650000-0x00000000036CC000-memory.dmp
      Filesize

      496KB

      Download
    • memory/4620-8-0x0000000003650000-0x00000000036D2000-memory.dmp
      Filesize

      520KB

      Download
    • memory/4620-7-0x0000000008540000-0x0000000008A60000-memory.dmp
      Filesize

      5.1MB

      Download
    • memory/4620-6-0x0000000073F00000-0x00000000745EE000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/4620-5-0x0000000005BF0000-0x0000000005BFA000-memory.dmp
      Filesize

      40KB

      Download
    • memory/4620-4-0x0000000005BA0000-0x0000000005BB0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4620-3-0x0000000005C60000-0x0000000005CF2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4620-2-0x0000000006160000-0x000000000665E000-memory.dmp
      Filesize

      5.0MB

      Download
    • memory/4620-0-0x0000000073F00000-0x00000000745EE000-memory.dmp
      Filesize

      6.9MB

      Download