Overview

overview

10

Static

static

10

14052163e5...43.exe

windows7-x64

10

14052163e5...43.exe

windows10-1703-x64

10

14052163e5...43.exe

windows10-2004-x64

10

14052163e5...43.exe

windows11-21h2-x64

10

Antimalwar...ble.js

windows7-x64

8

Antimalwar...ble.js

windows10-1703-x64

8

Antimalwar...ble.js

windows10-2004-x64

8

Antimalwar...ble.js

windows11-21h2-x64

8

EmbraTor M...et.exe

windows7-x64

1

EmbraTor M...et.exe

windows10-1703-x64

1

EmbraTor M...et.exe

windows10-2004-x64

1

EmbraTor M...et.exe

windows11-21h2-x64

1

Java Install.jar

windows7-x64

1

Java Install.jar

windows10-1703-x64

7

Java Install.jar

windows10-2004-x64

7

Java Install.jar

windows11-21h2-x64

7

MsMpEng.js

windows7-x64

10

MsMpEng.js

windows10-1703-x64

9

MsMpEng.js

windows10-2004-x64

10

MsMpEng.js

windows11-21h2-x64

10

Windows Dr...on.vbs

windows7-x64

10

Windows Dr...on.vbs

windows10-1703-x64

10

Windows Dr...on.vbs

windows10-2004-x64

10

Windows Dr...on.vbs

windows11-21h2-x64

10

Resubmissions

09-04-2024 13:34

240409-qvlrtabe9s 10

09-04-2024 13:34

240409-qvk6aabe81 10

09-04-2024 13:33

240409-qthzjabe5z 10

09-04-2024 13:33

240409-qthc1abe5y 10

07-07-2023 11:45

230707-nw632ahf6w 10

Analysis

  • max time kernel
    308s
  • max time network
    317s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-04-2024 10:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14052163e50c197697c64b143.exe

  • Size

    17.6MB

  • MD5

    14052163e50c197697c64b1431b42271

  • SHA1

    df301332faa73c3d5f915fde61df2fc9de21a61a

  • SHA256

    4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

  • SHA512

    124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab

  • SSDEEP

    393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg

Score
10/10
strratdiscoveryevasionpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

rar.ydns.eu:9999

svchost.ydns.eu:10000
Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    false

  • startup

    true

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://files.catbox.moe/fvl5hy.jpg

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 10 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
    "C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:4284
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1236
      • C:\Users\Admin\AppData\Local\Temp\x.exe
        "C:\Users\Admin\AppData\Local\Temp\x.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4704
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2336
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
            5⤵
            • Creates scheduled task(s)
            PID:4620
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2628
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 0
            5⤵
            • Delays execution with timeout.exe
            PID:644
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 0
            5⤵
            • Delays execution with timeout.exe
            PID:3544
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
      2⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3132
      • C:\Windows\system32\icacls.exe
        C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
        3⤵
        • Modifies file permissions
        PID:3508
    • C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
      "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2096
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3960 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1860
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3792
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3356
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3780
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:3272
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:212
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3820

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
      Filesize

      46B

      MD5

      544ed517c7576cbbb1b21db9d5d8979a

      SHA1

      990510ed3304404b8c22c377f2a356bff8925839

      SHA256

      b6806d616fb8c9d431dc4784f07376b7730fadd3ddf689d4fe302743f29b72ec

      SHA512

      ec409743cccef939749cf945bebdb876ce50dc4840fb406eeef9f8f698c22693f69237bcda1114cd933c8e9fed464572592e8cf3258bae8de53beb18e3eebf8d

      Download Submit

    • C:\ProgramData\rrrrrrrr.ps1
      Filesize

      437B

      MD5

      3ad705568172956efe092dfac809642c

      SHA1

      d34bfb981dd4478998ec767879ea00cd6406c496

      SHA256

      4247e7a94a7fd5e4266622a37d91770dfedb12587aff4c2ece7812c56bd2c1fb

      SHA512

      ef89e5b7eec05f3d9bbd2ab1fdd011c0917ef6241f6f0afba139860578498971559e2c66041c70b28a91fb09fdbb67eeee1d8a75179c65949028b45ecc813f97

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\32.exe
      Filesize

      7.4MB

      MD5

      7f9e6ee81558b38fbe276f60949d38b9

      SHA1

      6358b944b0515b04da8fe7fda7dc3dbbfb82423c

      SHA256

      6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb

      SHA512

      960966cc6254f15d5653ec9dbfe0fdc6725f2c1209b4ddb8b1c68d8f646521340f91029a53a5c8c60c9f813f3fe3e83644b052913178ac75886ccbd894be9ce3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\64.exe
      Filesize

      8.4MB

      MD5

      a2a5a9b937771a4b82694c844fd27e36

      SHA1

      402e2f7bfe1f24d6ea048d58bf156676132f515d

      SHA256

      390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68

      SHA512

      d352b147c8f045f9931725d25166916ce081ac5cf251f2987fb011deed2e8d3e08f91dbce8a2464abab5561b7915d69cbb7a0d02437b30b6fd3d5622621149e1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
      Filesize

      713KB

      MD5

      c958a31d5e439d5b0d01900e5a85992a

      SHA1

      fc40d0ef637fe55fbaf83e8f4891e008ac736df6

      SHA256

      e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf

      SHA512

      2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      Filesize

      722KB

      MD5

      43141e85e7c36e31b52b22ab94d5e574

      SHA1

      cfd7079a9b268d84b856dc668edbb9ab9ef35312

      SHA256

      ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

      SHA512

      9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
      Filesize

      14.6MB

      MD5

      cfe4b8f7535c958ea26cde6f32b559aa

      SHA1

      253ba3372c6c0b1c301f6e968c4fb7d5ffd696d0

      SHA256

      0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620

      SHA512

      01e8862cb7c1a3b247d09ca8e9f94c40232aaed93ab9f1937de0f69f83ba3d32926b6289b7bc5b8ae2bb06876b915a50ed65bb8ba10ffadcbbee579ce968bd39

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
      Filesize

      1012KB

      MD5

      5d57e6b8aff1ec900f553789f6796648

      SHA1

      f9a953cfe6decb237ed98c30faabec8654d99171

      SHA256

      3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d

      SHA512

      d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Java Install.jar
      Filesize

      92KB

      MD5

      c55f9247eb8ea19af96292f0893f86b5

      SHA1

      bd5e6884b8151114af7e45a92525893f4d2aaabd

      SHA256

      16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284

      SHA512

      3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
      Filesize

      24.2MB

      MD5

      690d57b0d8670391bad0876cae078bab

      SHA1

      32bea01d606128c606b71e19920099c6cb15030f

      SHA256

      b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458

      SHA512

      dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
      Filesize

      2KB

      MD5

      9160347bec74471e1a79edfd950629ae

      SHA1

      c149a7e5aab6e349a70b7b458d0eaaa9d301c790

      SHA256

      0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

      SHA512

      b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
      Filesize

      984B

      MD5

      df00d1e54f85ae90f2f69b73a34c90f4

      SHA1

      1d3e521a8efc17334f4f578432d5af0bb1ef1951

      SHA256

      2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c

      SHA512

      5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k4fn50st.lj1.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\autCE67.tmp
      Filesize

      14.6MB

      MD5

      2380aed7f261148fdb35af6688e408ee

      SHA1

      fa359778d16c934ba96b96f3c6c17a10a9e266b0

      SHA256

      12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4

      SHA512

      646bdbc4f01991460755c6a2c2dbbca0a0170c83d06050ba50ec1b5406d58f8035498c84462dd9e6ab1d695b8854e2f4734d64ec2f4ab1083371fd145963bb85

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\x.exe
      Filesize

      18.1MB

      MD5

      efcd72ad2d3430248a68e5f960ed5e2b

      SHA1

      58cc7d2732f401b99926211c0dab319dfc0bba1a

      SHA256

      41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8

      SHA512

      d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
      Filesize

      10KB

      MD5

      cbc4568c44a1b3ded5cf6b1a2e4b07ca

      SHA1

      29781e01d2cc44701ea632aa85b25babc5bbc0be

      SHA256

      e2c245caf3bd7286d060b365234a6471406a2fd23e6cd603c40fa83d9ef4fb40

      SHA512

      6b9e5bf345ecc1f95aa17f23f6a5625d3a5d2dd714cfee3debcf5d367ebe7591a30b7fea9ceccaf859874db375c4a4346cd2ef2e92c8035b232c3e8d037d3a04

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
      Filesize

      2.5MB

      MD5

      54183220aa6c777f8228474ff5b5df01

      SHA1

      ed438f17bffb37d42afd61d8dcef0c50d554c65c

      SHA256

      9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963

      SHA512

      70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
      Filesize

      2.7MB

      MD5

      ffcd5cbca9867eee8d74446c60ea6736

      SHA1

      1a14d9829b9ec3b18adbdca0f87df2fd34938992

      SHA256

      2089eed082364ed1e52980737b55c54c434f42fdf5048077b63e0dc5ee8e69c3

      SHA512

      e11ed7aab2389008bb02ed33cffaeeab18799acc1ebdecc9a84edc190a55dda41aa5543cc5d7a784e966cb3ab93973fe81a1b94db89e3600fff9017db083b6fb

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
      Filesize

      6.0MB

      MD5

      7d2c415f96adeb8d204702e4b37a0b0b

      SHA1

      32d220a2de37c2633572df69b1d488e0d7307f79

      SHA256

      9371c39667b5b590d40ba63f6cd128b0c60dea27d12b4f68c0fb4b30ea7e9dd4

      SHA512

      a3da0094de8d1bc3e7ccc1d8290dd2906d29620800279d5c061c87ee6e7476302c230e7cf831a37ab572a8ca27f8f1a0aa96841594e2e3f041d8a1882185ad00

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
      Filesize

      201B

      MD5

      b9d2fe9cfa840518fa39039c928d4938

      SHA1

      0561516b7cfa784cf400349983817c8b18817256

      SHA256

      69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776

      SHA512

      894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll
      Filesize

      3.4MB

      MD5

      791a48e7cf84ec1532d20127556f6300

      SHA1

      774f71e595cfc7e24dc941839566bc9edd9156c5

      SHA256

      af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff

      SHA512

      ecbb4a07bb68fec5258be0adc91b89d179b5668bbab3be3bd72d5339f8bf3b32a1860b38693a304029fe989bd92adb020cf755f673b1e59966dfc75e4f958cfa

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll
      Filesize

      974KB

      MD5

      be51ba4bea2d731dacf974c43941e457

      SHA1

      51fc479fd8ee9a2b72e6aa020ce5bb1c7a28f621

      SHA256

      98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747

      SHA512

      6184accd206aa466278c2f4b514fd5c85820d47cf3a148904e93927621ac386890e657f09547b694c32ef23c355ae738b7c7d039fcd6c791529198c7b0b6bd1e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll
      Filesize

      965KB

      MD5

      7847c7b13b3414e8e7652880b4609205

      SHA1

      930670acc16157f56aaf69423e5d7705441764ba

      SHA256

      38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb

      SHA512

      c3c81dc3eb546c40b3606338deadbd63331659645dd24b5fd0d4fb3170b053fef528ee3fe005c9446176a5c049e9412ea8193ad2f8b9a7301ff67b088f1bbb6e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll
      Filesize

      313KB

      MD5

      97d89dec5f6a236b6832a5f3f43ab625

      SHA1

      18f2696a3bf4d19cac3b677d58ff5e51bf54b9e8

      SHA256

      c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead

      SHA512

      7e82d1e37dc822a67e08bd1d624d5492f5813a33ec64f13d22caef9db35ebb9bb9913582289ebdecad00e6b6148d750ae0b4437364ef056d732734255498be54

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll
      Filesize

      608KB

      MD5

      624304f2ba253b33c265ff2738a10eb9

      SHA1

      5a337e49dd07f0b6f7fc6341755dc9a298e8b220

      SHA256

      27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f

      SHA512

      163820961a64b3fda33969cbb320aa743edc7a6bacebe033054c942e7a1d063f096290a59fad1569c607666429e2f3133fcfe31ef37649f9da71b453ef775e5a

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      Filesize

      4.3MB

      MD5

      9f2d86da7d58a70b0003307d9cfc2438

      SHA1

      bd69ad6ea837e309232d7c4fd0e87e22c3266ac5

      SHA256

      7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65

      SHA512

      ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll
      Filesize

      107KB

      MD5

      d490b6c224e332a706dd3cd210f32aa8

      SHA1

      1f0769e1fffddac3d14eb79f16508cb6cc272347

      SHA256

      da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557

      SHA512

      43ce8d4ee07d437aaca3f345af129ff5401f1f08b1292d1e320096ba41e2529f41ce9105e3901cb4ecb1e8fde12c9298819961b0e6896c69b62f5983df9b0da3

      Download Submit

    • memory/2800-104-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-71-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-66-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-175-0x00000000017D0000-0x00000000017D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2800-174-0x00000000017B0000-0x00000000017B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2800-182-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-144-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-163-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2800-162-0x00000000004B0000-0x00000000016D6000-memory.dmp

      Filesize

      18.1MB

      Download

    • memory/2892-70-0x0000000006080000-0x00000000060E6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2892-186-0x00000000737E0000-0x0000000073F90000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2892-57-0x00000000737E0000-0x0000000073F90000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2892-58-0x0000000002E20000-0x0000000002E56000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2892-61-0x00000000058B0000-0x0000000005ED8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/2892-60-0x0000000005270000-0x0000000005280000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2892-165-0x0000000007D70000-0x00000000083EA000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/2892-167-0x0000000006B40000-0x0000000006B5A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2892-64-0x0000000005270000-0x0000000005280000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2892-68-0x0000000005FE0000-0x0000000006002000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2892-72-0x00000000060F0000-0x0000000006156000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2892-82-0x0000000006160000-0x00000000064B4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/2892-103-0x00000000067D0000-0x000000000681C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/2892-101-0x0000000006700000-0x000000000671E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3132-117-0x0000020D45FC0000-0x0000020D46FC0000-memory.dmp

      Filesize

      16.0MB

      Download

    • memory/3132-159-0x0000020D462A0000-0x0000020D462B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3132-35-0x0000020D45FC0000-0x0000020D46FC0000-memory.dmp

      Filesize

      16.0MB

      Download

    • memory/3132-98-0x0000020D45FC0000-0x0000020D46FC0000-memory.dmp

      Filesize

      16.0MB

      Download

    • memory/3132-49-0x0000020D446E0000-0x0000020D446E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3132-161-0x0000020D46290000-0x0000020D462A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3132-109-0x0000020D446E0000-0x0000020D446E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3132-158-0x0000020D46250000-0x0000020D46260000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3132-124-0x0000020D446E0000-0x0000020D446E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3132-65-0x0000020D446E0000-0x0000020D446E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3132-134-0x0000020D45FC0000-0x0000020D46FC0000-memory.dmp

      Filesize

      16.0MB

      Download

    • memory/3132-154-0x0000020D45FC0000-0x0000020D46FC0000-memory.dmp

      Filesize

      16.0MB

      Download

    • memory/3132-156-0x0000020D46240000-0x0000020D46250000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3272-252-0x00000000649C0000-0x0000000064A58000-memory.dmp

      Filesize

      608KB

      Download

    • memory/3272-248-0x0000000000CA0000-0x0000000001101000-memory.dmp

      Filesize

      4.4MB

      Download

    • memory/3272-249-0x0000000064BA0000-0x0000000064C83000-memory.dmp

      Filesize

      908KB

      Download

    • memory/3272-250-0x0000000064B40000-0x0000000064B94000-memory.dmp

      Filesize

      336KB

      Download

    • memory/3272-251-0x0000000064A60000-0x0000000064B33000-memory.dmp

      Filesize

      844KB

      Download

    • memory/3272-253-0x0000000064990000-0x00000000649B3000-memory.dmp

      Filesize

      140KB

      Download

    • memory/3272-254-0x00000000646A0000-0x000000006498D000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/3272-256-0x0000000000CA0000-0x0000000001101000-memory.dmp

      Filesize

      4.4MB

      Download

    • memory/3272-263-0x0000000000CA0000-0x0000000001101000-memory.dmp

      Filesize

      4.4MB

      Download

    • memory/3780-219-0x000001CA072B0000-0x000001CA073D3000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3780-193-0x000001CA072B0000-0x000001CA073D3000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3780-198-0x000001CA072B0000-0x000001CA073D3000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3780-196-0x000001CA072B0000-0x000001CA073D3000-memory.dmp

      Filesize

      1.1MB

      Download