Overview

overview

10

Static

static

3

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows10-2004-x64

10

75bff99bec...45.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:54

240417-r96wzada86 10

17-04-2024 14:54

240417-r95znsee4v 10

17-04-2024 14:54

240417-r943dada82 10

17-04-2024 14:54

240417-r9353sda77 10

17-04-2024 14:54

240417-r93jjsee3x 10

15-04-2024 13:19

240415-qkln3afc75 10

10-04-2024 12:02

240410-n7v5xaeh49 10

10-04-2024 12:02

240410-n7vjdaaa8t 10

Analysis

  • max time kernel
    1195s
  • max time network
    1204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 12:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75bff99becc32bcbe56efbe7a75f4d45.exe

  • Size

    7.0MB

  • MD5

    75bff99becc32bcbe56efbe7a75f4d45

  • SHA1

    81bfcc77809161a5254a27d3d4d30548c96fcd5b

  • SHA256

    8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2

  • SHA512

    940af628585713a16e685eb5251c0b954bc014460cd4ca33226df2ef260f32af56223eaf1c341862fdf1669c6bafb6e7d9c5efbeb5e437ce5e2fd9905beece69

  • SSDEEP

    49152:uW/1GYdVTXN3r3+LXDIDAKpvuh3jwLN6/VNUKIdI9OiKuDbD2yvAkdm5wrgWX+5z:hXkZL/p

Score
10/10
bitratzgratpersistencerattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80

Attributes
  • communication_password

    d93b4f1ee6f5b875a4f7fcef966bd09a

  • tor_process

    WinSock

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 52 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 22 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
    "C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      2⤵
        PID:4676
      • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
        C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2420
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2172
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3640
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2720
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4684
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2736
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4544
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1564
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2296
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4812
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1516
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2472
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3084
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1368
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3600
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4828
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2320
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3320
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1552
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:5032
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1116
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4996
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2412
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4640
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3588
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1888
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2472
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:5084
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3784
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4700
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1636
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3852
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4660
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2376
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2244
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3336
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4040
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2032
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4224
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3776
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3636
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4852
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5200 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:8
        1⤵
          PID:1080

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Winlogon Helper DLL

        1
        T1547.004

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          Filesize

          973KB

          MD5

          5cfe61ff895c7daa889708665ef05d7b

          SHA1

          5e58efe30406243fbd58d4968b0492ddeef145f2

          SHA256

          f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

          SHA512

          43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
          Filesize

          20KB

          MD5

          a4aa02fba7767ea6c862daafcf0a2c09

          SHA1

          58e5b68cb1185a9e0c90cf381683306f9c5807ea

          SHA256

          77d295b3e9404b28a537554f040579b29b347d5ca63a58d680a7e1f061de75a2

          SHA512

          36e874aa164e8a48986794209c7c1cba99243a27926a185ae5ed907d4e5b4410a9c896c28840a8752c43b4634f5cda650a22b4cd3ddcae3462a7dc78632fb4b4

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdesc-consensus.tmp
          Filesize

          2.6MB

          MD5

          6fcc4b924d58bbb8462b7ee1961c7977

          SHA1

          41e1e2d4561bb169144e7d1a08c6a7f3dc731c2d

          SHA256

          edbc99c46f9d6785d0cedf6fa6de99e6c7a20187a738e29d55258584db2660ed

          SHA512

          2d3539570f1a6024c291c25a3aed2f61668ec03aa614b92118380a60510fab72878539f0bc3d51e1c8ce20f3b26400c35cd714fcf146dd3288a8da861ee5a6fe

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs
          Filesize

          20.3MB

          MD5

          9f4c15ed10850f658a5eced61ce0a282

          SHA1

          469268826b8fb7274f7e500008a023fef4b8b2c0

          SHA256

          851707262612b901a616ec4a7a94aa388990cf4624d89892a33bec08614bd728

          SHA512

          0b9bc61e15af8fed7dd80de80102a040be34108caeaa176adca896cb426505bd1cab6b20565e0d8fa1cb57ac63f67315c66beda354119b772369d1eaba249319

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
          Filesize

          5.5MB

          MD5

          395a1f1a71af7b2044b43410fc450243

          SHA1

          c4a18ccbfdd601e21993c4fd5790d16f019d526a

          SHA256

          dbfe6ed5486bd724339c633e214a319eb55baa981da8655e2c3f3b79e57dc420

          SHA512

          1bec3aa728ff66f032a0c0d849f046d5f4de66b12091946cb177528e858b980056ccd68b46daaf2b614a11773ca3d0c2762f9290a8e00f698d543c0a64b0a255

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
          Filesize

          20.3MB

          MD5

          17108faed7bb6a803799e16cdcaa53dc

          SHA1

          8fb9f7e1122184321e1eb41aaf5fd3b659b0504b

          SHA256

          4181a2f2c42c54861805e1cdd22fdc337fb21b73e706aaceac609e49f937e80b

          SHA512

          af1766c3097b7cab2131848f4f18cc4e501d2200a3c94e58cebba728d7fc7bd676fbda9e99f4bd60a9f797b0c8419b0c8a9625e47a170bcd13aceac0dfca45c3

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
          Filesize

          232B

          MD5

          b2b88e9e395c0f4634d2c3ff30f546e5

          SHA1

          5412c1ef90b7e22528fdec818cf3e3b301526a7a

          SHA256

          f1adb1310ef4c098902eb3c293bf638109a6b062b12710dcb6afdb057bc5d569

          SHA512

          24ab21fc5178fd697079b417dded92287e437dd927411211ef35f04850bd27e66ff3179157d6c51acdb9c34514d597e9269b84e2cdab9f08af8c1604b163b62a

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
          Filesize

          5KB

          MD5

          9dc570015082af504d1e73891a6711f4

          SHA1

          8aceb001863204f2ee4278d5712df25c98f99864

          SHA256

          66acafc8e1445a4368025d63522c989b3006796f2c22d48b6a210743a18abb1d

          SHA512

          ce7ec69f007f96ccc5db43c95e03d2b1f409226fbc9d5b3cb51074adc52d7151790fc0d60f6e0e989e9a52e65ddd25605a0ba7f801f06aa2ec8350a286422943

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
          Filesize

          3KB

          MD5

          e81302ca9bda62b02424bee2eca3b7e8

          SHA1

          1d608e3352ad7f43264cca65c8fb702bafca5def

          SHA256

          7c5b5f3d33caccbe2413805b66e5fb30adc3a71a83848fd534c519cc224c6dd8

          SHA512

          c086389725264718a24c8fcdf9c6e7941315f11f7e1c8e2bb6681008d0f6878c352c805364ac13a2430054e0b99b11749c2ed3a630169d932320a76f7f38c37b

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libcrypto-1_1.dll
          Filesize

          1.7MB

          MD5

          2384a02c4a1f7ec481adde3a020607d3

          SHA1

          7e848d35a10bf9296c8fa41956a3daa777f86365

          SHA256

          c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

          SHA512

          1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libevent-2-1-6.dll
          Filesize

          366KB

          MD5

          099983c13bade9554a3c17484e5481f1

          SHA1

          a84e69ad9722f999252d59d0ed9a99901a60e564

          SHA256

          b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

          SHA512

          89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libgcc_s_sjlj-1.dll
          Filesize

          286KB

          MD5

          b0d98f7157d972190fe0759d4368d320

          SHA1

          5715a533621a2b642aad9616e603c6907d80efc4

          SHA256

          2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

          SHA512

          41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssl-1_1.dll
          Filesize

          439KB

          MD5

          c88826ac4bb879622e43ead5bdb95aeb

          SHA1

          87d29853649a86f0463bfd9ad887b85eedc21723

          SHA256

          c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

          SHA512

          f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssp-0.dll
          Filesize

          88KB

          MD5

          2c916456f503075f746c6ea649cf9539

          SHA1

          fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

          SHA256

          cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

          SHA512

          1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libwinpthread-1.dll
          Filesize

          188KB

          MD5

          d407cc6d79a08039a6f4b50539e560b8

          SHA1

          21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

          SHA256

          92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

          SHA512

          378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\torrc
          Filesize

          157B

          MD5

          68afdef35a6105c2b148649bd05901b0

          SHA1

          828a2b590a95c2a411cc1b0004207747f2571024

          SHA256

          4e4e4e7f9fb03bcb898ce4f6075e3082d3a341d9fff1955ddf45089f83565622

          SHA512

          f198da05ec57c8525e6643f7f2c212701d0ab641d2850a28ce4cea7c33ac7b5c75782273bf7f01f95ccf02e27adf7c237ed116c5b0f220c13e70fe0aa7cfc671

          Download Submit
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\zlib1.dll
          Filesize

          52KB

          MD5

          add33041af894b67fe34e1dc819b7eb6

          SHA1

          6db46eb021855a587c95479422adcc774a272eeb

          SHA256

          8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

          SHA512

          bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

          Download Submit
        • memory/1940-19-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-65-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-27-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-29-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-31-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-33-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-35-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-37-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-39-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-41-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-43-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-45-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-47-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-49-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-51-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-53-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-55-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-59-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-57-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-61-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-63-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-23-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-67-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-69-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-71-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-73-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-25-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-2442-0x0000000075050000-0x0000000075800000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1940-21-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-17-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-15-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-11-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-13-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-10-0x0000000004DD0000-0x0000000004E4C000-memory.dmp
          Filesize

          496KB

          Download
        • memory/1940-9-0x0000000004DD0000-0x0000000004E52000-memory.dmp
          Filesize

          520KB

          Download
        • memory/1940-8-0x0000000005680000-0x0000000005690000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1940-7-0x0000000007DB0000-0x00000000082D0000-memory.dmp
          Filesize

          5.1MB

          Download
        • memory/1940-6-0x0000000075050000-0x0000000075800000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1940-0-0x0000000075050000-0x0000000075800000-memory.dmp
          Filesize

          7.7MB

          Download
        • memory/1940-5-0x00000000053B0000-0x00000000053BA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1940-4-0x0000000005680000-0x0000000005690000-memory.dmp
          Filesize

          64KB

          Download
        • memory/1940-3-0x0000000005410000-0x00000000054A2000-memory.dmp
          Filesize

          584KB

          Download
        • memory/1940-2-0x00000000058E0000-0x0000000005E84000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/1940-1-0x00000000002A0000-0x00000000009A8000-memory.dmp
          Filesize

          7.0MB

          Download
        • memory/2172-2480-0x00000000740E0000-0x0000000074104000-memory.dmp
          Filesize

          144KB

          Download
        • memory/2172-2515-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2172-2488-0x0000000074340000-0x000000007440E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/2172-2489-0x0000000074110000-0x000000007421A000-memory.dmp
          Filesize

          1.0MB

          Download
        • memory/2172-2479-0x0000000074220000-0x0000000074269000-memory.dmp
          Filesize

          292KB

          Download
        • memory/2172-2484-0x0000000074050000-0x00000000740D8000-memory.dmp
          Filesize

          544KB

          Download
        • memory/2172-2506-0x0000000074270000-0x0000000074338000-memory.dmp
          Filesize

          800KB

          Download
        • memory/2172-2598-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2172-2516-0x0000000001880000-0x0000000001908000-memory.dmp
          Filesize

          544KB

          Download
        • memory/2172-2517-0x0000000002030000-0x00000000022FF000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/2172-2485-0x0000000001880000-0x0000000001908000-memory.dmp
          Filesize

          544KB

          Download
        • memory/2172-2486-0x0000000002030000-0x00000000022FF000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/2172-2470-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2172-2487-0x0000000073D80000-0x000000007404F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/2172-2473-0x0000000074270000-0x0000000074338000-memory.dmp
          Filesize

          800KB

          Download
        • memory/2420-2505-0x0000000000400000-0x0000000000BD8000-memory.dmp
          Filesize

          7.8MB

          Download
        • memory/2420-2444-0x0000000074F60000-0x0000000074F99000-memory.dmp
          Filesize

          228KB

          Download
        • memory/2420-2653-0x00000000739E0000-0x0000000073A19000-memory.dmp
          Filesize

          228KB

          Download
        • memory/2420-2441-0x0000000000400000-0x0000000000BD8000-memory.dmp
          Filesize

          7.8MB

          Download
        • memory/2420-2496-0x0000000073A50000-0x0000000073A89000-memory.dmp
          Filesize

          228KB

          Download
        • memory/2720-2665-0x0000000074140000-0x000000007440F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/2720-2654-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2720-2711-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2720-2664-0x0000000073FA0000-0x000000007406E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/2720-2663-0x0000000074070000-0x0000000074138000-memory.dmp
          Filesize

          800KB

          Download
        • memory/2720-2621-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/2720-2628-0x0000000074500000-0x0000000074549000-memory.dmp
          Filesize

          292KB

          Download
        • memory/2720-2627-0x0000000074070000-0x0000000074138000-memory.dmp
          Filesize

          800KB

          Download
        • memory/2720-2629-0x00000000744D0000-0x00000000744F4000-memory.dmp
          Filesize

          144KB

          Download
        • memory/2720-2630-0x0000000073E90000-0x0000000073F9A000-memory.dmp
          Filesize

          1.0MB

          Download
        • memory/2720-2631-0x0000000073E00000-0x0000000073E88000-memory.dmp
          Filesize

          544KB

          Download
        • memory/2720-2632-0x0000000073FA0000-0x000000007406E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/2720-2633-0x0000000074140000-0x000000007440F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/3640-2595-0x0000000074270000-0x0000000074338000-memory.dmp
          Filesize

          800KB

          Download
        • memory/3640-2612-0x0000000074270000-0x0000000074338000-memory.dmp
          Filesize

          800KB

          Download
        • memory/3640-2596-0x0000000074340000-0x000000007440E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/3640-2599-0x0000000074220000-0x0000000074269000-memory.dmp
          Filesize

          292KB

          Download
        • memory/3640-2611-0x0000000073D80000-0x000000007404F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/3640-2614-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/3640-2613-0x0000000074340000-0x000000007440E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/3640-2594-0x0000000073D80000-0x000000007404F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/3640-2592-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download
        • memory/3640-2601-0x0000000074110000-0x000000007421A000-memory.dmp
          Filesize

          1.0MB

          Download
        • memory/3640-2600-0x00000000740E0000-0x0000000074104000-memory.dmp
          Filesize

          144KB

          Download
        • memory/3640-2603-0x0000000074050000-0x00000000740D8000-memory.dmp
          Filesize

          544KB

          Download
        • memory/4684-2712-0x0000000074500000-0x0000000074549000-memory.dmp
          Filesize

          292KB

          Download
        • memory/4684-2713-0x00000000744D0000-0x00000000744F4000-memory.dmp
          Filesize

          144KB

          Download
        • memory/4684-2714-0x0000000073E90000-0x0000000073F9A000-memory.dmp
          Filesize

          1.0MB

          Download
        • memory/4684-2710-0x0000000073FA0000-0x000000007406E000-memory.dmp
          Filesize

          824KB

          Download
        • memory/4684-2715-0x0000000073E00000-0x0000000073E88000-memory.dmp
          Filesize

          544KB

          Download
        • memory/4684-2707-0x0000000074140000-0x000000007440F000-memory.dmp
          Filesize

          2.8MB

          Download
        • memory/4684-2709-0x0000000074070000-0x0000000074138000-memory.dmp
          Filesize

          800KB

          Download
        • memory/4684-2705-0x0000000000E10000-0x0000000001214000-memory.dmp
          Filesize

          4.0MB

          Download