Analysis Overview
SHA256
da9365d6a36e9aac5c61c0a9c0fd53f2c3d03954e0e3b215f43435a5b638acf6
Threat Level: Known bad
The file b88ab587582517006609d2554572f9f4_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Bitrat family
BitRAT
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
ACProtect 1.3x - 1.4x DLL software
Adds Run key to start application
Looks up external IP address via web service
UPX packed file
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious behavior: RenamesItself
Modifies system certificate store
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-02 13:57
Signatures
Bitrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-02 13:57
Reported
2024-12-02 14:00
Platform
win7-20240903-en
Max time kernel
149s
Max time network
156s
Command Line
Signatures
BitRAT
Bitrat family
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe" | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
Network
| Country | Destination | Domain | Proto |
| US | 50.7.74.172:443 | tcp | |
| N/A | 127.0.0.1:49231 | tcp | |
| US | 96.253.78.108:443 | tcp | |
| DE | 62.141.38.69:443 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| FR | 163.172.176.167:443 | tcp | |
| AT | 86.59.21.38:443 | tcp | |
| DK | 85.235.250.88:443 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| GR | 185.4.132.148:443 | tcp | |
| SE | 109.105.109.162:60784 | tcp | |
| DE | 157.90.183.103:9001 | tcp | |
| DE | 157.90.183.103:9001 | tcp | |
| SE | 109.105.109.162:60784 | tcp | |
| N/A | 127.0.0.1:49351 | tcp | |
| FI | 65.108.3.114:1066 | tcp | |
| DE | 144.76.81.198:8443 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 8.8.8.8:53 | myexternalip.com | udp |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | r10.o.lencr.org | udp |
| NL | 95.101.74.210:80 | r10.o.lencr.org | tcp |
| N/A | 127.0.0.1:49450 | tcp | |
| FR | 94.23.172.32:444 | tcp | |
| FI | 65.108.3.114:1066 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | crl.microsoft.com | udp |
| DE | 104.124.11.17:80 | crl.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| FR | 23.41.213.121:80 | www.microsoft.com | tcp |
| FI | 135.181.63.118:9100 | tcp | |
| N/A | 127.0.0.1:49526 | tcp | |
| FR | 94.23.172.32:444 | tcp | |
| FI | 65.108.3.114:1066 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| N/A | 127.0.0.1:49594 | tcp | |
| DE | 185.220.101.48:20048 | tcp | |
| FR | 94.23.172.32:444 | tcp |
Files
memory/1792-0-0x0000000000400000-0x0000000000BD8000-memory.dmp
\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
| MD5 | 5cfe61ff895c7daa889708665ef05d7b |
| SHA1 | 5e58efe30406243fbd58d4968b0492ddeef145f2 |
| SHA256 | f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5 |
| SHA512 | 43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da |
memory/1792-18-0x0000000004040000-0x0000000004444000-memory.dmp
memory/1100-21-0x00000000013A0000-0x00000000017A4000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\libcrypto-1_1.dll
| MD5 | 2384a02c4a1f7ec481adde3a020607d3 |
| SHA1 | 7e848d35a10bf9296c8fa41956a3daa777f86365 |
| SHA256 | c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369 |
| SHA512 | 1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503 |
memory/1792-17-0x0000000004040000-0x0000000004444000-memory.dmp
\Users\Admin\AppData\Local\89d22e83\tor\libssp-0.dll
| MD5 | 2c916456f503075f746c6ea649cf9539 |
| SHA1 | fa1afc1f3d728c89b2e90e14ca7d88b599580a9d |
| SHA256 | cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6 |
| SHA512 | 1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd |
C:\Users\Admin\AppData\Local\89d22e83\tor\libevent-2-1-6.dll
| MD5 | 099983c13bade9554a3c17484e5481f1 |
| SHA1 | a84e69ad9722f999252d59d0ed9a99901a60e564 |
| SHA256 | b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838 |
| SHA512 | 89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2 |
C:\Users\Admin\AppData\Local\89d22e83\tor\libgcc_s_sjlj-1.dll
| MD5 | b0d98f7157d972190fe0759d4368d320 |
| SHA1 | 5715a533621a2b642aad9616e603c6907d80efc4 |
| SHA256 | 2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5 |
| SHA512 | 41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496 |
C:\Users\Admin\AppData\Local\89d22e83\tor\libwinpthread-1.dll
| MD5 | d407cc6d79a08039a6f4b50539e560b8 |
| SHA1 | 21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71 |
| SHA256 | 92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e |
| SHA512 | 378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c |
memory/1100-36-0x00000000746F0000-0x0000000074778000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\libssl-1_1.dll
| MD5 | c88826ac4bb879622e43ead5bdb95aeb |
| SHA1 | 87d29853649a86f0463bfd9ad887b85eedc21723 |
| SHA256 | c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f |
| SHA512 | f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3 |
memory/1100-33-0x0000000074040000-0x000000007414A000-memory.dmp
memory/1100-30-0x0000000074150000-0x0000000074218000-memory.dmp
memory/1100-26-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1100-25-0x0000000074220000-0x00000000744EF000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\zlib1.dll
| MD5 | add33041af894b67fe34e1dc819b7eb6 |
| SHA1 | 6db46eb021855a587c95479422adcc774a272eeb |
| SHA256 | 8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183 |
| SHA512 | bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa |
memory/1100-42-0x0000000074820000-0x0000000074844000-memory.dmp
memory/1792-41-0x0000000004040000-0x0000000004444000-memory.dmp
memory/1100-39-0x0000000073F70000-0x000000007403E000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\torrc
| MD5 | 644896c07049391168b23e7cbd46dcf0 |
| SHA1 | 4dbdc7933b3984b6894ba5b05952de68586ef734 |
| SHA256 | a09a2fa3765c77e7dfdacc46f16da82448131b6d44754cdf984bc5b5aeb0d12f |
| SHA512 | 20faaa8ce578d9a11d4b86308a797a95d7d0757e120807b42d504b1a799dfc3131d3c3ab7610467cc4f4573ad35117c008b43b90996725b9f22647d5679decbb |
memory/1100-46-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1100-47-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/1100-48-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1100-50-0x0000000074150000-0x0000000074218000-memory.dmp
memory/1792-49-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1100-51-0x0000000074040000-0x000000007414A000-memory.dmp
memory/1100-52-0x00000000746F0000-0x0000000074778000-memory.dmp
memory/1100-53-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/1100-54-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-62-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1100-63-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-71-0x0000000000400000-0x0000000000BD8000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdesc-consensus.tmp
| MD5 | 0030ec38fb64384275255ed67bb74abe |
| SHA1 | 245c5b5fc9102f3fb73a442caad840663c3c98c2 |
| SHA256 | f48dc4b7791869e3d8a11420c100232a1f3ff3e95cfb4f926061c61a9ffccbda |
| SHA512 | 0d786a7786464006cb1d2d3740e1cd5da0aaba109d853fda92ce50bdd296667a140a1e81e614d612bb0a701324cf0b2ec514c2f932d585b836ebd3fb63552589 |
memory/1100-83-0x00000000013A0000-0x00000000017A4000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new
| MD5 | e9c41616912c34b6b59528779e5eb05f |
| SHA1 | 921709969c30880d31aaa1439f3d9e46d6d3e679 |
| SHA256 | 94819c5ebbeb3b2aea240d3a908c49444e255341b87ee982caf41bb0f9c2e003 |
| SHA512 | ef3078a956158d264d723239349acff77e5b5a407de97ceeb25ea695cf10a728f280d662ecec746e28305692ab24cd3a7494384d9c1dcc6c9401157893fa3dae |
memory/1100-108-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1100-125-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-140-0x0000000004BE0000-0x0000000004FE4000-memory.dmp
memory/2424-141-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2424-148-0x0000000074820000-0x0000000074844000-memory.dmp
memory/2424-147-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/2424-146-0x0000000074040000-0x000000007414A000-memory.dmp
memory/2424-145-0x00000000746F0000-0x0000000074778000-memory.dmp
memory/2424-144-0x0000000074150000-0x0000000074218000-memory.dmp
memory/2424-143-0x0000000074780000-0x00000000747C9000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-certs
| MD5 | 4f85bfa3f905003b7f77309774653404 |
| SHA1 | 3cf056921de5631d2df9b992c3b2d6169f23355a |
| SHA256 | c00e96bb87763bc6d0ada5582afc7dba1217bfd1a83e8e3b01ad42a32e54fcea |
| SHA512 | c9a501a930fd665b75728d8780568b11474a9ec5e65af26b3bcd1803c8b47919eab73e192e1e11460dd3c83278104dc2e40e44314869fed0e871d5f03883d14b |
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | d77472ffb7510c53967379874015c638 |
| SHA1 | d9850d931e85c88dbd5b2590fbd46d597c48d11b |
| SHA256 | 771e4f8dc6178fd7e117be8665467d2bbb48cfb625c1ad0b50f82fc83be9801b |
| SHA512 | fdde1382fefad6804cbf9f86add6e9b5d69705f67e276dae4ec6e5aa703006c975eb45e37acbcbf90b88201d42a9f15ab69cdd6ebce19149b7112968308c5c31 |
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new
| MD5 | 90838f333af7b22b964bef8b22aade9f |
| SHA1 | a57e48a416796297a41a4f6ecf086fa349d73696 |
| SHA256 | 491dab0cac60477e170c80a8f65c90a9619e52a96a9cfb3a71cb5881154b5b75 |
| SHA512 | 57fd8b9be4b88277aa17276077d8536b01d5d8c87878699f4ea30a20d4abbafba23a7c5778ee11cbb104aea3a3186b35b00ff7e80b60b5053a303f5c97e02691 |
memory/2424-142-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/1792-139-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1792-161-0x0000000004BE0000-0x0000000004FE4000-memory.dmp
memory/2424-162-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2424-165-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/2424-164-0x0000000074150000-0x0000000074218000-memory.dmp
memory/2424-163-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/2424-166-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2424-175-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-193-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/1792-192-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/2296-236-0x00000000746F0000-0x0000000074778000-memory.dmp
memory/2296-238-0x0000000074820000-0x0000000074844000-memory.dmp
memory/2296-237-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/2296-235-0x0000000074040000-0x000000007414A000-memory.dmp
memory/2296-234-0x0000000074150000-0x0000000074218000-memory.dmp
memory/2296-233-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/2296-232-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/2296-231-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-230-0x0000000005970000-0x0000000005D74000-memory.dmp
memory/2424-229-0x00000000013A0000-0x00000000017A4000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | 5bdbbff3fc3675e9e82b254c6a56f9b2 |
| SHA1 | 13b422dc199b10f3adaf944551340a6e00515da4 |
| SHA256 | a04f4d5a8d4077420b88862e688aeed34637d7a24b6587150283a73c059677c1 |
| SHA512 | b952dcaf995d1916d6f276604bc541bf2ddfff16f5412f339c3db9c5eb4f13d0b3224cf6663d5a43734596ea717715e040fb4a3c09237a6fed214d03e6d6d9cf |
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs
| MD5 | 8b0ab82b2b3fe5b9c3213b41e388a710 |
| SHA1 | 4c8b24ba57517b53dfb6d3c404091fa8bcb69b8e |
| SHA256 | 8d96bf2e0d2a470891c835edbe5203f1ef3b88bebb49f06e78da272c89f8fe8c |
| SHA512 | be9f7571c8c04671f380e2fedd18c5a3a79a11de8783d82b4ddcf66a733bf861d1474ac6f388f167e19d92af2ad4bc6230cb3c546de780c420680f8f0f7bece2 |
memory/1792-243-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/1792-244-0x0000000000CD0000-0x0000000000CDA000-memory.dmp
memory/1792-247-0x0000000005970000-0x0000000005D74000-memory.dmp
memory/2296-248-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2296-249-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/2296-251-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/2296-250-0x0000000074150000-0x0000000074218000-memory.dmp
memory/1792-271-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/1792-270-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/2296-281-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2500-303-0x00000000747A0000-0x00000000747C4000-memory.dmp
memory/2500-302-0x00000000741B0000-0x000000007427E000-memory.dmp
memory/2500-301-0x0000000074280000-0x0000000074308000-memory.dmp
memory/2500-300-0x0000000074310000-0x000000007441A000-memory.dmp
memory/2500-299-0x0000000074420000-0x00000000744E8000-memory.dmp
memory/2500-298-0x0000000074730000-0x0000000074779000-memory.dmp
memory/2500-297-0x0000000073120000-0x00000000733EF000-memory.dmp
memory/2500-296-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/1792-295-0x0000000005970000-0x0000000005D74000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | d43b3732d91e746d0c70c77176f4ddfa |
| SHA1 | 0030347845fa58489a934e14f56072d1aceb7a90 |
| SHA256 | 5a5312ba3bdd16582e4a01b4cc48d8bab1974f5c1b7b222f9fda187e20fb9285 |
| SHA512 | 78273f714277371af8093b508823154d4ebd0b9f5f34a97f4760f5d4406dec3defcae003a3c5a4bea3a3006ee6d77dd546363c7b0332c3df182a87ca35597fbc |
memory/1792-306-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/1792-308-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/1792-311-0x0000000005970000-0x0000000005D74000-memory.dmp
memory/2500-312-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2500-314-0x0000000074420000-0x00000000744E8000-memory.dmp
memory/2500-315-0x00000000741B0000-0x000000007427E000-memory.dmp
memory/2500-313-0x0000000073120000-0x00000000733EF000-memory.dmp
memory/1792-334-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/2500-344-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2268-358-0x00000000013A0000-0x00000000017A4000-memory.dmp
memory/2268-365-0x0000000074820000-0x0000000074844000-memory.dmp
memory/2268-364-0x0000000073F70000-0x000000007403E000-memory.dmp
memory/2268-363-0x00000000746F0000-0x0000000074778000-memory.dmp
memory/2268-362-0x0000000074040000-0x000000007414A000-memory.dmp
memory/2268-361-0x0000000074150000-0x0000000074218000-memory.dmp
memory/2268-360-0x0000000074780000-0x00000000747C9000-memory.dmp
memory/1792-357-0x0000000005970000-0x0000000005D74000-memory.dmp
memory/2268-359-0x0000000074220000-0x00000000744EF000-memory.dmp
memory/1792-367-0x0000000004D40000-0x0000000004D4A000-memory.dmp
memory/1792-366-0x0000000004D40000-0x0000000004D4A000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-02 13:57
Reported
2024-12-02 14:00
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
BitRAT
Bitrat family
ACProtect 1.3x - 1.4x DLL software
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe" | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prscrt = "C:\\Users\\Admin\\AppData\\Local\\AppData\\prscrt.exe먀" | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
| N/A | myexternalip.com | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe | N/A |
Suspicious behavior: RenamesItself
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b88ab587582517006609d2554572f9f4_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
"C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe" -f torrc
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| DE | 131.188.40.188:80 | tcp | |
| US | 8.8.8.8:53 | 188.40.188.131.in-addr.arpa | udp |
| SE | 193.11.114.43:9001 | tcp | |
| N/A | 127.0.0.1:63128 | tcp | |
| GB | 140.238.101.233:9001 | tcp | |
| DE | 144.76.162.202:8080 | tcp | |
| US | 8.8.8.8:53 | 43.114.11.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.101.238.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.162.76.144.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:45808 | tcp | |
| DE | 144.76.162.202:8080 | tcp | |
| GB | 140.238.101.233:9001 | tcp | |
| PL | 185.241.208.101:443 | tcp | |
| US | 8.8.8.8:53 | 101.208.241.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | myexternalip.com | udp |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | 145.111.160.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | r10.o.lencr.org | udp |
| NL | 95.101.74.205:80 | r10.o.lencr.org | tcp |
| US | 8.8.8.8:53 | 49.113.40.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.74.101.95.in-addr.arpa | udp |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.209.201.84.in-addr.arpa | udp |
| DE | 103.252.90.236:9300 | tcp | |
| US | 8.8.8.8:53 | 236.90.252.103.in-addr.arpa | udp |
| N/A | 127.0.0.1:63240 | tcp | |
| N/A | 127.0.0.1:63269 | tcp | |
| NL | 192.42.115.101:9003 | tcp | |
| US | 8.8.8.8:53 | 101.115.42.192.in-addr.arpa | udp |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | 223.74.101.95.in-addr.arpa | udp |
| N/A | 127.0.0.1:63339 | tcp | |
| NL | 204.137.14.60:443 | tcp | |
| DE | 103.252.90.236:9300 | tcp | |
| US | 8.8.8.8:53 | 60.14.137.204.in-addr.arpa | udp |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 8.8.8.8:53 | 25.125.209.23.in-addr.arpa | udp |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| DE | 195.90.200.83:9001 | tcp | |
| N/A | 127.0.0.1:63401 | tcp | |
| NL | 204.137.14.60:443 | tcp | |
| US | 8.8.8.8:53 | 83.200.90.195.in-addr.arpa | udp |
| DE | 103.252.90.236:9300 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
| N/A | 127.0.0.1:63453 | tcp | |
| LT | 213.183.60.21:443 | tcp | |
| DE | 103.252.90.236:9300 | tcp | |
| NL | 204.137.14.60:443 | tcp | |
| N/A | 127.0.0.1:45808 | tcp | |
| US | 34.160.111.145:443 | myexternalip.com | tcp |
Files
memory/3656-0-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3656-1-0x0000000074920000-0x0000000074959000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\winscprt.exe
| MD5 | 5cfe61ff895c7daa889708665ef05d7b |
| SHA1 | 5e58efe30406243fbd58d4968b0492ddeef145f2 |
| SHA256 | f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5 |
| SHA512 | 43b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da |
C:\Users\Admin\AppData\Local\89d22e83\tor\libssl-1_1.dll
| MD5 | c88826ac4bb879622e43ead5bdb95aeb |
| SHA1 | 87d29853649a86f0463bfd9ad887b85eedc21723 |
| SHA256 | c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f |
| SHA512 | f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3 |
C:\Users\Admin\AppData\Local\89d22e83\tor\libssp-0.dll
| MD5 | 2c916456f503075f746c6ea649cf9539 |
| SHA1 | fa1afc1f3d728c89b2e90e14ca7d88b599580a9d |
| SHA256 | cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6 |
| SHA512 | 1c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd |
C:\Users\Admin\AppData\Local\89d22e83\tor\zlib1.dll
| MD5 | add33041af894b67fe34e1dc819b7eb6 |
| SHA1 | 6db46eb021855a587c95479422adcc774a272eeb |
| SHA256 | 8688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183 |
| SHA512 | bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa |
C:\Users\Admin\AppData\Local\89d22e83\tor\libwinpthread-1.dll
| MD5 | d407cc6d79a08039a6f4b50539e560b8 |
| SHA1 | 21171adbc176dc19aaa5e595cd2cd4bd1dfd0c71 |
| SHA256 | 92cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e |
| SHA512 | 378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c |
C:\Users\Admin\AppData\Local\89d22e83\tor\torrc
| MD5 | 644896c07049391168b23e7cbd46dcf0 |
| SHA1 | 4dbdc7933b3984b6894ba5b05952de68586ef734 |
| SHA256 | a09a2fa3765c77e7dfdacc46f16da82448131b6d44754cdf984bc5b5aeb0d12f |
| SHA512 | 20faaa8ce578d9a11d4b86308a797a95d7d0757e120807b42d504b1a799dfc3131d3c3ab7610467cc4f4573ad35117c008b43b90996725b9f22647d5679decbb |
C:\Users\Admin\AppData\Local\89d22e83\tor\libgcc_s_sjlj-1.dll
| MD5 | b0d98f7157d972190fe0759d4368d320 |
| SHA1 | 5715a533621a2b642aad9616e603c6907d80efc4 |
| SHA256 | 2922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5 |
| SHA512 | 41ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496 |
memory/4516-24-0x0000000000170000-0x0000000000574000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\libevent-2-1-6.dll
| MD5 | 099983c13bade9554a3c17484e5481f1 |
| SHA1 | a84e69ad9722f999252d59d0ed9a99901a60e564 |
| SHA256 | b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838 |
| SHA512 | 89f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2 |
C:\Users\Admin\AppData\Local\89d22e83\tor\libcrypto-1_1.dll
| MD5 | 2384a02c4a1f7ec481adde3a020607d3 |
| SHA1 | 7e848d35a10bf9296c8fa41956a3daa777f86365 |
| SHA256 | c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369 |
| SHA512 | 1ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503 |
memory/4516-40-0x0000000073810000-0x0000000073898000-memory.dmp
memory/4516-39-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/4516-38-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/4516-37-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/4516-42-0x00000000737E0000-0x0000000073804000-memory.dmp
memory/4516-41-0x0000000001390000-0x0000000001418000-memory.dmp
memory/4516-44-0x00000000738A0000-0x00000000739AA000-memory.dmp
memory/4516-43-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdesc-consensus.tmp
| MD5 | 0030ec38fb64384275255ed67bb74abe |
| SHA1 | 245c5b5fc9102f3fb73a442caad840663c3c98c2 |
| SHA256 | f48dc4b7791869e3d8a11420c100232a1f3ff3e95cfb4f926061c61a9ffccbda |
| SHA512 | 0d786a7786464006cb1d2d3740e1cd5da0aaba109d853fda92ce50bdd296667a140a1e81e614d612bb0a701324cf0b2ec514c2f932d585b836ebd3fb63552589 |
memory/3656-53-0x00000000733D0000-0x0000000073409000-memory.dmp
memory/3656-54-0x0000000000400000-0x0000000000BD8000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new
| MD5 | 594a1951366a18f0c7c17d5f7d9ffaf9 |
| SHA1 | 76d4ebfc5402de3e65ef755b62c894cec20877da |
| SHA256 | d6a11915f2eeb2b6a3979f8da1071d01cad567286656c2e9c48a1d633b626173 |
| SHA512 | c0433d45b09e355aaede846ac1997404eae86b874b09f937be965f17080f5cd40712768ae4831bdd22667dcffa83189b71c93f30fffc3bbd191d542bd86b7328 |
memory/4516-71-0x0000000000170000-0x0000000000574000-memory.dmp
memory/4516-72-0x0000000000170000-0x0000000000574000-memory.dmp
memory/4516-80-0x0000000001390000-0x0000000001418000-memory.dmp
memory/3656-81-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/4516-88-0x0000000000170000-0x0000000000574000-memory.dmp
memory/3656-96-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/4516-97-0x0000000000170000-0x0000000000574000-memory.dmp
memory/4516-106-0x0000000001390000-0x0000000001418000-memory.dmp
memory/3980-117-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/3980-116-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/3980-122-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/3980-121-0x0000000073870000-0x000000007397A000-memory.dmp
memory/3980-120-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/3980-119-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/3980-118-0x0000000073A00000-0x0000000073ACE000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-certs
| MD5 | 622056089c4276261f4377df7a873e98 |
| SHA1 | da9ca39d357921671b87cbdf343ccbec88cf2df9 |
| SHA256 | d9baae7c29e72b05b6cea62eadafabd5fa039d27814d564eeeade040b065d5aa |
| SHA512 | 78d269e93c6fb902f963b59d6b02c87c9d88611525edaf76db83423cc39ec0586a2310abe9888c16378a50eb8683550ea826bff54a8782ada083c73acf9deffc |
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | d77472ffb7510c53967379874015c638 |
| SHA1 | d9850d931e85c88dbd5b2590fbd46d597c48d11b |
| SHA256 | 771e4f8dc6178fd7e117be8665467d2bbb48cfb625c1ad0b50f82fc83be9801b |
| SHA512 | fdde1382fefad6804cbf9f86add6e9b5d69705f67e276dae4ec6e5aa703006c975eb45e37acbcbf90b88201d42a9f15ab69cdd6ebce19149b7112968308c5c31 |
memory/3980-115-0x0000000000170000-0x0000000000574000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs.new
| MD5 | 92fc048f480de572780d62d47d25526c |
| SHA1 | bfae3833b55c18f43f46ca2b250a6660097426b6 |
| SHA256 | 8c94761542622ba32372b3eaccc39a3fcd7cf3212ad6ae9ecf4e4205cb3e44d1 |
| SHA512 | 0948553c672cb14154c573fe34c60f82221f28052a6cce2b3136fca49838e384764b1b4f434cd71aa624e259afcb8a10be7774eb8d0e5a26a50b34845488dfdb |
memory/3400-142-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/3400-145-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/3400-147-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/3400-149-0x0000000001350000-0x000000000161F000-memory.dmp
memory/3400-144-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/3400-161-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/3400-162-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/3400-160-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/3400-159-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/3400-158-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/3400-157-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/3400-156-0x0000000073870000-0x000000007397A000-memory.dmp
memory/3400-151-0x0000000000170000-0x0000000000574000-memory.dmp
memory/3400-143-0x0000000073870000-0x000000007397A000-memory.dmp
memory/3400-141-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/3400-140-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/3980-164-0x0000000000170000-0x0000000000574000-memory.dmp
memory/3656-163-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3980-167-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/3980-169-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/3980-168-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/3980-170-0x0000000000170000-0x0000000000574000-memory.dmp
memory/3980-179-0x0000000000170000-0x0000000000574000-memory.dmp
memory/3656-187-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/3980-189-0x0000000000170000-0x0000000000574000-memory.dmp
memory/1140-212-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/1140-211-0x0000000073870000-0x000000007397A000-memory.dmp
memory/1140-210-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/1140-209-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/1140-208-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/1140-207-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/1140-206-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/1140-205-0x0000000000170000-0x0000000000574000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | 684938d05792e2e62ba50f7c18ca0e0f |
| SHA1 | f87b57a6f183d4da087da8713819f76be7ec01d6 |
| SHA256 | bd7c2b670fc98f20e2565585c73b49b84a5ae00cc9264efb75bec2edfe949215 |
| SHA512 | 075a5847ccf532ac637ae1d6389d7b4bc8ab4e7b6cdfbc63910476ed8a3543bf27e84940d1b53e568593560a25d7dac0af93f25d87f6c55fa893b8691f6c6e29 |
C:\Users\Admin\AppData\Local\89d22e83\tor\data\cached-microdescs
| MD5 | 92f4cc9ee10769f5c19fd6aefdaef31b |
| SHA1 | acddbfd9fc017e2c78a3b2916e82d611337a14d5 |
| SHA256 | 8d5cdb78ccd895557addcd5e78913080b394a574f58b01042fe0a695eee5f35a |
| SHA512 | 10e6aa082c42e2cf8f4ac11bf39a6361204a1c39703e43c4757765b1be6b175d40e1d0141f53eb50b8270f8164c2ce1f6b694e57c288834d2093c05bd170a71e |
memory/3656-218-0x0000000000400000-0x0000000000BD8000-memory.dmp
memory/1140-219-0x0000000000170000-0x0000000000574000-memory.dmp
memory/1140-220-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/1140-221-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/1140-222-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/3656-231-0x0000000074920000-0x0000000074959000-memory.dmp
memory/1140-251-0x0000000000170000-0x0000000000574000-memory.dmp
memory/4388-265-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/4388-266-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/4388-264-0x0000000073870000-0x000000007397A000-memory.dmp
memory/4388-263-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/4388-262-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/4388-261-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/4388-260-0x0000000073AD0000-0x0000000073B98000-memory.dmp
C:\Users\Admin\AppData\Local\89d22e83\tor\data\state
| MD5 | c37c26f772602476c66a0dbcb7060cd2 |
| SHA1 | f6431f881ed0c3e333e0919f77574ef2f232c7a4 |
| SHA256 | 6b473712d957ec89590fb4048dd4542e429f10a60c50bbf901059688b8ed0227 |
| SHA512 | a4e11158ed005783b3f867c7c238e547d61c0c624f4c82cdca113f0f484da4d8a7224ed1bf188b14dcd20d5f5735c182f239f1c202340aa9ce03c1e5a7226bc8 |
memory/4388-272-0x0000000000170000-0x0000000000574000-memory.dmp
memory/4388-273-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/4388-274-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/4388-276-0x0000000073870000-0x000000007397A000-memory.dmp
memory/4388-275-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/4388-285-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/4388-305-0x0000000000170000-0x0000000000574000-memory.dmp
memory/5072-311-0x0000000073BA0000-0x0000000073E6F000-memory.dmp
memory/5072-310-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/5072-309-0x0000000073870000-0x000000007397A000-memory.dmp
memory/5072-308-0x00000000739B0000-0x00000000739F9000-memory.dmp
memory/5072-307-0x0000000000170000-0x0000000000574000-memory.dmp
memory/5072-315-0x0000000000170000-0x0000000000574000-memory.dmp
memory/5072-316-0x0000000073AD0000-0x0000000073B98000-memory.dmp
memory/5072-317-0x0000000073A00000-0x0000000073ACE000-memory.dmp
memory/5072-320-0x00000000737E0000-0x0000000073868000-memory.dmp
memory/5072-319-0x0000000073870000-0x000000007397A000-memory.dmp
memory/5072-318-0x0000000073980000-0x00000000739A4000-memory.dmp
memory/5072-329-0x0000000073BA0000-0x0000000073E6F000-memory.dmp