Resubmissions
11/04/2024, 07:23
240411-h79qeaee771011/04/2024, 07:22
240411-h7ha6aee651011/04/2024, 07:22
240411-h7g1dshf5x1011/04/2024, 07:22
240411-h7gdvsee631011/04/2024, 07:22
240411-h7fsbshf5w1007/04/2024, 08:58
240407-kxh6tahg751007/04/2024, 07:55
240407-jr6jgsgd3z1007/04/2024, 07:54
240407-jrz2psgh281007/04/2024, 07:54
240407-jrvf8agd3w1007/04/2024, 07:51
240407-jqb89agg7610Analysis
- max time kernel
1798s - max time network
1801s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
11/04/2024, 07:23
General
- Target 6ec74da2134bd56250ca32be04b9b697.exe
- Size 7.8MB
- Sample240411-h79qeaee77
- SHA256 1ab1a15e1e4a19c7d77a01f00de5d401bc7ab0ffaa33c332788aadeeedddc386
Malware Config
Extracted
-
bitrat
-
1.33
-
bkc56e3jgy5zlfq7ialxyppztuh4dgranlyauupid4uc2ze5hg2cshqd.onion:80
-
communication_password
a0439c943ecd02cca78474e6b334f67e
-
install_dir
Java_update
-
install_file
java_update.exe
-
tor_process
adobe
Signatures
- BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
- ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 24 IoCs
- Looks up external IP address via web service 49 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 52 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec74da2134bd56250ca32be04b9b697.exe"C:\Users\Admin\AppData\Local\Temp\6ec74da2134bd56250ca32be04b9b697.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ttttt.exe"C:\Users\Admin\AppData\Local\Temp\ttttt.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe"C:\Users\Admin\AppData\Local\a0d62031\tor\adobe.exe" -f torrc3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ttttt.exe
adobe.exe
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
cached-microdescs.new
state
libcrypto-1_1.dll
torrc
libevent-2-1-6.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
zlib1.dll
memory/436-44-0x00000000730F0000-0x0000000073139000-memory.dmp
memory/436-149-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-113-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-105-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-183-0x0000000001540000-0x00000000015C8000-memory.dmp
memory/436-48-0x0000000072F50000-0x0000000073018000-memory.dmp
memory/436-47-0x0000000073020000-0x00000000730EE000-memory.dmp
memory/436-180-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-50-0x0000000072B70000-0x0000000072C7A000-memory.dmp
memory/436-49-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/436-52-0x0000000001540000-0x00000000015C8000-memory.dmp
memory/436-51-0x0000000072AE0000-0x0000000072B68000-memory.dmp
memory/436-53-0x0000000001540000-0x000000000180F000-memory.dmp
memory/436-54-0x0000000072C80000-0x0000000072F4F000-memory.dmp
memory/436-30-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-122-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-141-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-133-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-83-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-84-0x00000000730F0000-0x0000000073139000-memory.dmp
memory/436-85-0x0000000073020000-0x00000000730EE000-memory.dmp
memory/436-86-0x0000000072F50000-0x0000000073018000-memory.dmp
memory/436-90-0x0000000072C80000-0x0000000072F4F000-memory.dmp
memory/436-91-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-92-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/436-103-0x0000000001540000-0x00000000015C8000-memory.dmp
memory/436-104-0x0000000001540000-0x000000000180F000-memory.dmp
memory/1356-313-0x0000000073A40000-0x0000000073A89000-memory.dmp
memory/1356-314-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/2236-170-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/2236-179-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/2236-194-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/2236-193-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/2236-187-0x0000000072C80000-0x0000000072F4F000-memory.dmp
memory/2236-172-0x0000000072F50000-0x0000000073018000-memory.dmp
memory/2236-174-0x0000000073020000-0x00000000730EE000-memory.dmp
memory/2236-177-0x00000000730F0000-0x0000000073139000-memory.dmp
memory/2236-197-0x00000000730F0000-0x0000000073139000-memory.dmp
memory/2236-195-0x0000000072F50000-0x0000000073018000-memory.dmp
memory/2236-181-0x0000000072B70000-0x0000000072C7A000-memory.dmp
memory/2236-196-0x0000000073020000-0x00000000730EE000-memory.dmp
memory/2236-184-0x0000000072AE0000-0x0000000072B68000-memory.dmp
memory/3132-235-0x0000000072CB0000-0x0000000072CEA000-memory.dmp
memory/3132-121-0x0000000073350000-0x000000007338A000-memory.dmp
memory/3132-66-0x00000000727D0000-0x000000007280A000-memory.dmp
memory/3132-15-0x0000000073A50000-0x0000000073A8A000-memory.dmp
memory/3284-278-0x0000000072F30000-0x0000000072FFE000-memory.dmp
memory/3284-276-0x00000000731A0000-0x0000000073268000-memory.dmp
memory/3284-302-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/3284-301-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/3284-300-0x0000000072F30000-0x0000000072FFE000-memory.dmp
memory/3284-299-0x00000000731A0000-0x0000000073268000-memory.dmp
memory/3284-292-0x0000000073270000-0x000000007353F000-memory.dmp
memory/3284-288-0x0000000073000000-0x0000000073088000-memory.dmp
memory/3284-285-0x0000000073090000-0x000000007319A000-memory.dmp
memory/3284-283-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/3284-280-0x0000000073A40000-0x0000000073A89000-memory.dmp
memory/4360-216-0x0000000073000000-0x0000000073088000-memory.dmp
memory/4360-217-0x0000000073090000-0x000000007319A000-memory.dmp
memory/4360-209-0x00000000731A0000-0x0000000073268000-memory.dmp
memory/4360-236-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/4360-248-0x00000000731A0000-0x0000000073268000-memory.dmp
memory/4360-219-0x0000000073270000-0x000000007353F000-memory.dmp
memory/4360-210-0x0000000073A40000-0x0000000073A89000-memory.dmp
memory/4360-218-0x0000000072F30000-0x0000000072FFE000-memory.dmp
memory/4360-212-0x0000000073AC0000-0x0000000073AE4000-memory.dmp
memory/4360-295-0x0000000000D30000-0x0000000001134000-memory.dmp
memory/5032-7-0x00000000034B0000-0x00000000034C0000-memory.dmp
memory/5032-2-0x0000000001B50000-0x0000000001B58000-memory.dmp
memory/5032-1-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmp
memory/5032-3-0x00000000034B0000-0x00000000034C0000-memory.dmp
memory/5032-6-0x00000000034B0000-0x00000000034C0000-memory.dmp
memory/5032-5-0x00000000034B0000-0x00000000034C0000-memory.dmp
memory/5032-0-0x0000000000BF0000-0x00000000013CC000-memory.dmp
memory/5032-13-0x00007FFCCBCE0000-0x00007FFCCC6CC000-memory.dmp
memory/5032-4-0x00000000034B0000-0x00000000034C0000-memory.dmp