Overview

overview

10

Static

static

3

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows7-x64

10

75bff99bec...45.exe

windows10-1703-x64

10

75bff99bec...45.exe

windows10-2004-x64

10

75bff99bec...45.exe

windows11-21h2-x64

10

Resubmissions

17-04-2024 14:54

240417-r96wzada86 10

17-04-2024 14:54

240417-r95znsee4v 10

17-04-2024 14:54

240417-r943dada82 10

17-04-2024 14:54

240417-r9353sda77 10

17-04-2024 14:54

240417-r93jjsee3x 10

15-04-2024 13:19

240415-qkln3afc75 10

10-04-2024 12:02

240410-n7v5xaeh49 10

10-04-2024 12:02

240410-n7vjdaaa8t 10

Analysis

  • max time kernel
    1198s
  • max time network
    1201s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75bff99becc32bcbe56efbe7a75f4d45.exe

  • Size

    7.0MB

  • MD5

    75bff99becc32bcbe56efbe7a75f4d45

  • SHA1

    81bfcc77809161a5254a27d3d4d30548c96fcd5b

  • SHA256

    8c05da461e90984671ffd87f0e4e28e057cca4d32a0569764dcdcce2d545fac2

  • SHA512

    940af628585713a16e685eb5251c0b954bc014460cd4ca33226df2ef260f32af56223eaf1c341862fdf1669c6bafb6e7d9c5efbeb5e437ce5e2fd9905beece69

  • SSDEEP

    49152:uW/1GYdVTXN3r3+LXDIDAKpvuh3jwLN6/VNUKIdI9OiKuDbD2yvAkdm5wrgWX+5z:hXkZL/p

Score
10/10
bitratzgratpersistencerattrojanupx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

obqdy2u226qjiavs42z4z6zgcf6tefsoxaqzjvohmoy7kafdwgqgjkqd.onion:80

Attributes
  • communication_password

    d93b4f1ee6f5b875a4f7fcef966bd09a

  • tor_process

    WinSock

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Detect ZGRat V1 34 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • ACProtect 1.3x - 1.4x DLL software 7 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 53 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 30 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 33 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
    "C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3908
    • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
      2⤵
        PID:408
      • C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
        C:\Users\Admin\AppData\Local\Temp\75bff99becc32bcbe56efbe7a75f4d45.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:436
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1192
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4560
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1336
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4668
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4344
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5100
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2124
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1296
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4108
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3908
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1784
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3232
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3512
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2040
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2448
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4040
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1348
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4728
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4180
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3664
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:216
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4496
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4084
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3156
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1856
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3736
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3104
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3300
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4484
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3208
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3176
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1536
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1608
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1180
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1400
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2744
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3992
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3748
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4672
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2344
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:940
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1604
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2776
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4716
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4628
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3484
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:5076
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4092
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:3832
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:4120
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:1668
        • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
          "C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe" -f torrc
          3⤵
          • Executes dropped EXE
          PID:2508

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\WinSock.exe
      Filesize

      973KB

      MD5

      5cfe61ff895c7daa889708665ef05d7b

      SHA1

      5e58efe30406243fbd58d4968b0492ddeef145f2

      SHA256

      f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5

      SHA512

      43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
      Filesize

      20KB

      MD5

      197b14232c3de9ca84af81b90e48f992

      SHA1

      ada6d5a9299c6537b95649962ef863dc7d4f3777

      SHA256

      0b95722d73a69ead7db298b068308796a9993558428bb7306675672acd473d2f

      SHA512

      9be8a4ae62f93f56951ffe597e1e3934f594d4bfcbd58b28b82b7242195f592c2ab19408f4a86759d7c6dd013e47ff0eaad5f5d2eb8efec0e16a82d1c873d14c

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-certs
      Filesize

      20KB

      MD5

      492d506afb32e6660dc8f219f47e0272

      SHA1

      1145f7b0a1c618afd36e56f07c8593a3a11bcc8d

      SHA256

      89c8642916f7a8346480bb720cf9b7dedce7ea25d997b30d2a5c6b5d2fea1c1c

      SHA512

      52b1d1487c23ab99784ec62d2e6a0735c81567aaa3368a5441e695596cd8ea54de9d656722f0d361599523b6912c738a5fda34ba37a5cfb7b7199ea87b330643

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdesc-consensus.tmp
      Filesize

      2.6MB

      MD5

      8c8bc1908db7ac54e1dd393839811249

      SHA1

      00d3e7d05a0abd7dd8d764a13a90d027c06382a4

      SHA256

      b684399e3c8c9fe286edc15d8a6e14ea9ae7795ea7b5371865140e50fb678b3a

      SHA512

      438d374c3c0ba6db776767906f8ee5cadc4e6042c26f2da4715049f697a7d63e7d178c0e191b8edf91ed1e401401f813c34cd66c0f0b9911826d0b913f3de6d4

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs
      Filesize

      10.6MB

      MD5

      0acf4738721ea2941e0765c30dbe8d32

      SHA1

      7ba0ade26cb93273aa3f1df6ebbb8de07f0cccbd

      SHA256

      ca90bc516f3c131cba6246736e60178483485a871ea66556d5e0c8d64a4d927c

      SHA512

      37868a6bc8a724242ca2c4e38540d5d5cf91ad61c4d4f37f2705e9ea0b56cd8395b14f22e69b628e4fc80e75b30db3509f348aad3665cdaf692dc8b9334dc708

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
      Filesize

      10.6MB

      MD5

      06fd6b85ae8cfd763636cdd54adc9e9f

      SHA1

      2df9d31f2bc3ebd32c2d8a26f17ed943bcd4f199

      SHA256

      280b0fddde5562f21ca40fa4a99ad3da38fc0c2099fca2f804d4cdccf085ce57

      SHA512

      3e50b8341bcfb783a2823ca897f80774816741ce72060b1986852ed921221c60cb1a6292d3cd27ce5465e5b6e04e4300593341dd7bfad2744783a3732abd9ae3

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
      Filesize

      5.7MB

      MD5

      a79a64652f4ba5aaaed56176c5a6e79f

      SHA1

      6af89d911d11ae7b195d3c4f0f7c2309c27a9d5a

      SHA256

      47281159eb2044ea37944ea35fde126a4407990234df5f9e862e83ec1d55062b

      SHA512

      20adfe0d81e75433dfc7613e87ad63ac4e850fe62d318c2ba2130a14fc882964b7639713d7c2cd154bcc3195b1e60203916ce2aa0168be1ed114c697d03209ea

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\cached-microdescs.new
      Filesize

      9.6MB

      MD5

      2b1741bb14314920920a3e73e5b1bc83

      SHA1

      ac6acc117aa7b59b19598d3e678200b455bf649a

      SHA256

      ef730e705f88c1f03b0552bf61b3c72acb222ceb8806793d692b01d49802519d

      SHA512

      1851df4e15925ebbdf5522ac234cf26e4ce8e5fe885041b169d985008e286d63db52204de2dda63590ec03d02f83f61235109352b4713d8beaf040ca9ca716a9

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
      Filesize

      232B

      MD5

      8069f91f40b312de3bdf0e878ec0ca39

      SHA1

      52311add79be2c4702b176cde77b04f5cab5ee4d

      SHA256

      cba1d50d4c2d22ec1b83e4feb78eb4cd09b577d893f42fc4b9f2d5b1de25efb3

      SHA512

      dc8663be4452fe7453db899b3946775680c0f944478e27050f7269675c6ab1e62a381ca5361ee881cbd27b0d53e9c88e8e46e23e88f92e04f209d6ef29540ed4

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\data\state
      Filesize

      3KB

      MD5

      c3a7bec433c9316772eb4a5df063399d

      SHA1

      bbefd61bd31b1d40dd03c23382b07373d68c17da

      SHA256

      c28b1a1465c00807e563b6b900b70f0427622f6d5b23b4e9510fdab56500a1a4

      SHA512

      3c58f7c804c63e78381ea3863fd7392148b7671c34dc950b351193e4ea74632120e2b0ccc8dc6bcdec5af35538f4f2ee65a0492abe053b260ed5193119403894

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libcrypto-1_1.dll
      Filesize

      1.7MB

      MD5

      2384a02c4a1f7ec481adde3a020607d3

      SHA1

      7e848d35a10bf9296c8fa41956a3daa777f86365

      SHA256

      c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369

      SHA512

      1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libevent-2-1-6.dll
      Filesize

      366KB

      MD5

      099983c13bade9554a3c17484e5481f1

      SHA1

      a84e69ad9722f999252d59d0ed9a99901a60e564

      SHA256

      b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838

      SHA512

      89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libgcc_s_sjlj-1.dll
      Filesize

      286KB

      MD5

      b0d98f7157d972190fe0759d4368d320

      SHA1

      5715a533621a2b642aad9616e603c6907d80efc4

      SHA256

      2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5

      SHA512

      41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssl-1_1.dll
      Filesize

      439KB

      MD5

      c88826ac4bb879622e43ead5bdb95aeb

      SHA1

      87d29853649a86f0463bfd9ad887b85eedc21723

      SHA256

      c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f

      SHA512

      f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libssp-0.dll
      Filesize

      88KB

      MD5

      2c916456f503075f746c6ea649cf9539

      SHA1

      fa1afc1f3d728c89b2e90e14ca7d88b599580a9d

      SHA256

      cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6

      SHA512

      1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\libwinpthread-1.dll
      Filesize

      188KB

      MD5

      d407cc6d79a08039a6f4b50539e560b8

      SHA1

      21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71

      SHA256

      92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e

      SHA512

      378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\torrc
      Filesize

      157B

      MD5

      68afdef35a6105c2b148649bd05901b0

      SHA1

      828a2b590a95c2a411cc1b0004207747f2571024

      SHA256

      4e4e4e7f9fb03bcb898ce4f6075e3082d3a341d9fff1955ddf45089f83565622

      SHA512

      f198da05ec57c8525e6643f7f2c212701d0ab641d2850a28ce4cea7c33ac7b5c75782273bf7f01f95ccf02e27adf7c237ed116c5b0f220c13e70fe0aa7cfc671

      Download Submit

    • C:\Users\Admin\AppData\Local\d4f7be4f\tor\zlib1.dll
      Filesize

      52KB

      MD5

      add33041af894b67fe34e1dc819b7eb6

      SHA1

      6db46eb021855a587c95479422adcc774a272eeb

      SHA256

      8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183

      SHA512

      bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa

      Download Submit

    • memory/436-2481-0x0000000073D40000-0x0000000073E08000-memory.dmp

      Filesize

      800KB

      Download

    • memory/436-2482-0x0000000073D10000-0x0000000073D34000-memory.dmp

      Filesize

      144KB

      Download

    • memory/436-2484-0x0000000073B30000-0x0000000073C3A000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/436-2485-0x0000000001410000-0x00000000016DF000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/436-2486-0x0000000073860000-0x0000000073B2F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/436-2487-0x00000000737D0000-0x0000000073858000-memory.dmp

      Filesize

      544KB

      Download

    • memory/436-2488-0x0000000073E10000-0x0000000073E59000-memory.dmp

      Filesize

      292KB

      Download

    • memory/436-2505-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/436-2483-0x0000000073C40000-0x0000000073D0E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/436-2514-0x0000000000830000-0x00000000008B8000-memory.dmp

      Filesize

      544KB

      Download

    • memory/436-2582-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/436-2480-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1192-2583-0x0000000073D40000-0x0000000073E08000-memory.dmp

      Filesize

      800KB

      Download

    • memory/1192-2581-0x0000000073860000-0x0000000073B2F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/1192-2580-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1192-2585-0x0000000073C40000-0x0000000073D0E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/1192-2589-0x0000000073D10000-0x0000000073D34000-memory.dmp

      Filesize

      144KB

      Download

    • memory/1192-2587-0x0000000073E10000-0x0000000073E59000-memory.dmp

      Filesize

      292KB

      Download

    • memory/1192-2592-0x0000000073B30000-0x0000000073C3A000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1192-2594-0x00000000737D0000-0x0000000073858000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1192-2598-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1192-2599-0x0000000073860000-0x0000000073B2F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/1192-2600-0x0000000073D40000-0x0000000073E08000-memory.dmp

      Filesize

      800KB

      Download

    • memory/1192-2601-0x0000000073C40000-0x0000000073D0E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/1336-2704-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1336-2716-0x0000000073B90000-0x0000000073E5F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/1336-2717-0x0000000073AC0000-0x0000000073B88000-memory.dmp

      Filesize

      800KB

      Download

    • memory/1336-2718-0x0000000073850000-0x000000007391E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/1336-2719-0x0000000073F50000-0x0000000073F99000-memory.dmp

      Filesize

      292KB

      Download

    • memory/1336-2724-0x00000000739B0000-0x0000000073ABA000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1336-2725-0x0000000073920000-0x00000000739A8000-memory.dmp

      Filesize

      544KB

      Download

    • memory/1336-2720-0x0000000073F20000-0x0000000073F44000-memory.dmp

      Filesize

      144KB

      Download

    • memory/1336-2750-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/1336-2753-0x0000000073B90000-0x0000000073E5F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/1336-2754-0x0000000073AC0000-0x0000000073B88000-memory.dmp

      Filesize

      800KB

      Download

    • memory/1336-2756-0x0000000073850000-0x000000007391E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/3908-46-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-16-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3908-2441-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3908-97-0x0000000005CF0000-0x0000000005D00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3908-72-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-70-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-66-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-68-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-64-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-2-0x00000000060C0000-0x0000000006664000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3908-3-0x0000000005A50000-0x0000000005AE2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/3908-62-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-60-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-58-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-56-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-54-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-52-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-50-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-48-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-0-0x0000000000970000-0x0000000001078000-memory.dmp

      Filesize

      7.0MB

      Download

    • memory/3908-44-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-42-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-40-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-38-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-36-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-34-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-32-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-30-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-4-0x0000000005CF0000-0x0000000005D00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3908-5-0x0000000005C20000-0x0000000005C2A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3908-6-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3908-7-0x0000000008220000-0x0000000008740000-memory.dmp

      Filesize

      5.1MB

      Download

    • memory/3908-8-0x0000000003380000-0x0000000003402000-memory.dmp

      Filesize

      520KB

      Download

    • memory/3908-9-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-10-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-28-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-26-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-12-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-14-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-18-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-24-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-22-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/3908-20-0x0000000003380000-0x00000000033FC000-memory.dmp

      Filesize

      496KB

      Download

    • memory/4560-2613-0x0000000073AC0000-0x0000000073B88000-memory.dmp

      Filesize

      800KB

      Download

    • memory/4560-2715-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4560-2620-0x00000000739B0000-0x0000000073ABA000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4560-2647-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4560-2621-0x0000000073920000-0x00000000739A8000-memory.dmp

      Filesize

      544KB

      Download

    • memory/4560-2623-0x0000000073B90000-0x0000000073E5F000-memory.dmp

      Filesize

      2.8MB

      Download

    • memory/4560-2619-0x0000000073F20000-0x0000000073F44000-memory.dmp

      Filesize

      144KB

      Download

    • memory/4560-2614-0x0000000073F50000-0x0000000073F99000-memory.dmp

      Filesize

      292KB

      Download

    • memory/4560-2656-0x0000000073AC0000-0x0000000073B88000-memory.dmp

      Filesize

      800KB

      Download

    • memory/4560-2622-0x0000000073850000-0x000000007391E000-memory.dmp

      Filesize

      824KB

      Download

    • memory/4668-2771-0x0000000000A00000-0x0000000000E04000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/4684-2646-0x0000000073630000-0x0000000073669000-memory.dmp

      Filesize

      228KB

      Download

    • memory/4684-2749-0x00000000724B0000-0x00000000724E9000-memory.dmp

      Filesize

      228KB

      Download

    • memory/4684-2504-0x0000000000400000-0x0000000000BD8000-memory.dmp

      Filesize

      7.8MB

      Download

    • memory/4684-2495-0x00000000733C0000-0x00000000733F9000-memory.dmp

      Filesize

      228KB

      Download

    • memory/4684-2442-0x0000000000400000-0x0000000000BD8000-memory.dmp

      Filesize

      7.8MB

      Download

    • memory/4684-2444-0x00000000749B0000-0x00000000749E9000-memory.dmp

      Filesize

      228KB

      Download