hxxp://dark[.]fail

Analysis

max time kernel
1181s
max time network
1183s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://dark.fail
Sample240509-ydmxjsbc5w

Score

8^/10

evasion trojan

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	tor-browser-windows-x86_64-portable-13.0.14.exe

Executes dropped EXE 27 IoCs

pid	Process
5976	tor-browser-windows-x86_64-portable-13.0.14.exe
1704	firefox.exe
5284	firefox.exe
5704	firefox.exe
4176	firefox.exe
5976	firefox.exe
4764	tor.exe
5548	firefox.exe
5948	firefox.exe
5668	firefox.exe
5888	firefox.exe
2420	firefox.exe
5688	lyrebird.exe
5080	lyrebird.exe
5556	lyrebird.exe
4344	lyrebird.exe
5452	lyrebird.exe
720	firefox.exe
4948	firefox.exe
3508	firefox.exe
5140	firefox.exe
4020	firefox.exe
6020	firefox.exe
2860	firefox.exe
5736	firefox.exe
6360	firefox.exe
6872	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
5976	tor-browser-windows-x86_64-portable-13.0.14.exe
5976	tor-browser-windows-x86_64-portable-13.0.14.exe
5976	tor-browser-windows-x86_64-portable-13.0.14.exe
1704	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
4176	firefox.exe
5976	firefox.exe
5976	firefox.exe
5976	firefox.exe
5976	firefox.exe
5548	firefox.exe
5548	firefox.exe
5548	firefox.exe
5548	firefox.exe
4176	firefox.exe
4176	firefox.exe
5948	firefox.exe
5948	firefox.exe
5948	firefox.exe
5948	firefox.exe
5948	firefox.exe
5948	firefox.exe
5976	firefox.exe
5976	firefox.exe
5668	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
2420	firefox.exe
5668	firefox.exe
5668	firefox.exe
5668	firefox.exe
5888	firefox.exe
5888	firefox.exe
5668	firefox.exe
5668	firefox.exe
2420	firefox.exe
2420	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe
720	firefox.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{CD806826-5CF0-44BD-AEB3-D531F900A284}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tor-browser-windows-x86_64-portable-13.0.14.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 753364.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3412	msedge.exe
3412	msedge.exe
3036	identity_helper.exe
3036	identity_helper.exe
1648	msedge.exe
1648	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
5844	msedge.exe
5844	msedge.exe
5688	lyrebird.exe
5688	lyrebird.exe
5556	lyrebird.exe
5556	lyrebird.exe
5080	lyrebird.exe
5080	lyrebird.exe
4344	lyrebird.exe
4344	lyrebird.exe
5452	lyrebird.exe
5452	lyrebird.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2316	mmc.exe

Suspicious behavior: LoadsDriver 14 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: 33	5624	mmc.exe
Token: SeIncBasePriorityPrivilege	5624	mmc.exe
Token: 33	5624	mmc.exe
Token: SeIncBasePriorityPrivilege	5624	mmc.exe
Token: SeSecurityPrivilege	5624	mmc.exe
Token: 33	5624	mmc.exe
Token: SeIncBasePriorityPrivilege	5624	mmc.exe
Token: 33	5624	mmc.exe
Token: SeIncBasePriorityPrivilege	5624	mmc.exe
Token: 33	5624	mmc.exe
Token: SeIncBasePriorityPrivilege	5624	mmc.exe
Token: SeDebugPrivilege	5284	firefox.exe
Token: SeDebugPrivilege	5284	firefox.exe
Token: SeManageVolumePrivilege	2252	svchost.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe
Token: SeSecurityPrivilege	2316	mmc.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe
Token: 33	2316	mmc.exe
Token: SeIncBasePriorityPrivilege	2316	mmc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe
3412	msedge.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
5624	mmc.exe
5624	mmc.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
5284	firefox.exe
2316	mmc.exe
2316	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 212	3412	msedge.exe	80
PID 3412 wrote to memory of 212	3412	msedge.exe	80
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3912	3412	msedge.exe	81
PID 3412 wrote to memory of 3404	3412	msedge.exe	82
PID 3412 wrote to memory of 3404	3412	msedge.exe	82
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83
PID 3412 wrote to memory of 2488	3412	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dark.fail
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3048 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,2785574662354537540,14672058634279303846,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5844
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.0.14.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.0.14.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:5976
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1704
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5284
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.0.389702332\1871419755" -parentBuildID 20240416150000 -prefsHandle 2184 -prefMapHandle 1952 -prefsLen 19248 -prefMapSize 243660 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {22766eee-4445-4a18-8753-aba421c61258} 5284 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5704
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.1.1735945172\353792956" -childID 1 -isForBrowser -prefsHandle 2740 -prefMapHandle 2936 -prefsLen 20081 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {1befd203-5208-4f69-9c68-76f66e6c55c7} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4176
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:6d8403974604c2d16061fe438666ff3552f413a96e0d4aa8ce53feb6ad +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 5284 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:4764
      - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        TorBrowser\Tor\PluggableTransports\lyrebird.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5452
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.2.530999427\29899511" -childID 2 -isForBrowser -prefsHandle 2440 -prefMapHandle 3328 -prefsLen 20899 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {33234bed-7d01-4c67-8935-ad3bf2fc469f} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5976
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.3.1211566891\1685749585" -childID 3 -isForBrowser -prefsHandle 3804 -prefMapHandle 3800 -prefsLen 20976 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {721c6f79-5c0a-4b36-b982-f9a7f5a19971} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5548
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.4.1966403859\1293263430" -parentBuildID 20240416150000 -prefsHandle 3944 -prefMapHandle 3728 -prefsLen 22151 -prefMapSize 243660 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {240b7ef1-bfe4-4d7a-bfd5-700f4216b341} 5284 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5948
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.5.1532593477\1536542708" -childID 4 -isForBrowser -prefsHandle 4040 -prefMapHandle 3292 -prefsLen 22199 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {1ed1d835-2bda-40e1-a75f-f4514f132a7d} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5668
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.6.1245200308\514062131" -childID 5 -isForBrowser -prefsHandle 4300 -prefMapHandle 4296 -prefsLen 22199 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b956c218-37b2-4a6f-a5bf-6389dbb10c3b} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5888
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.7.1940438982\1458857413" -childID 6 -isForBrowser -prefsHandle 4448 -prefMapHandle 4452 -prefsLen 22199 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {71910c9d-721f-4a26-b136-71a2c8633a88} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2420
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5688
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5080
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5556
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4344
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.8.572236113\574749994" -childID 7 -isForBrowser -prefsHandle 2728 -prefMapHandle 4928 -prefsLen 23205 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {4b2b8f23-fc6e-4afe-8ee4-fa5453cc113a} 5284 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:720
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.9.1948542828\1566157611" -childID 8 -isForBrowser -prefsHandle 4176 -prefMapHandle 4844 -prefsLen 23373 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {aa5e8814-88d9-4a87-a1b7-924f9852e89e} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:4948
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.10.2008310395\353366442" -childID 9 -isForBrowser -prefsHandle 5296 -prefMapHandle 5300 -prefsLen 23373 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {9e0cfd11-644f-4f7d-80d4-4e8e63deaf31} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:3508
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.11.82645459\341079200" -childID 10 -isForBrowser -prefsHandle 5624 -prefMapHandle 5620 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {0c7aa49d-0120-4fd9-86d3-40067b2f7a2b} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:5140
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.12.327784130\1146070460" -childID 11 -isForBrowser -prefsHandle 5868 -prefMapHandle 5872 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {86095b46-c84f-4855-a0f8-3e06c674be20} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:4020
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.13.1166045997\1454180015" -childID 12 -isForBrowser -prefsHandle 6112 -prefMapHandle 6048 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {72a248ef-a7f0-4d45-a586-0d650d5d87d3} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:6020
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.14.702536126\1256370005" -childID 13 -isForBrowser -prefsHandle 6104 -prefMapHandle 5792 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {af0cac91-05a3-49f6-915d-d21a2989b6a6} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:2860
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.15.630940945\1751790975" -childID 14 -isForBrowser -prefsHandle 4636 -prefMapHandle 4288 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {71cc2256-f307-42c7-b2fa-7f90f931f037} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:5736
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.16.1476780274\2020303692" -childID 15 -isForBrowser -prefsHandle 5900 -prefMapHandle 5888 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {0dbcd7c2-98f8-4f4d-bddb-1d284a51acf4} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:6360
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5284.17.901708859\588021198" -childID 16 -isForBrowser -prefsHandle 4236 -prefMapHandle 5612 -prefsLen 23438 -prefMapSize 243660 -jsInitHandle 1256 -jsInitLen 240916 -parentBuildID 20240416150000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {6c1bebcc-550f-46e2-9d2b-048158d2865d} 5284 tab
        5⤵
        Executes dropped EXE
        
        PID:6872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultaf1bdd1bhae87h4dd6hab2bhd1396e515617
1⤵
PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1448,8030879892466990088,5117366552769520486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  PID:5184

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault5d41d35bh89e0h45fbh8dd2h3d2411a5cdfe
1⤵
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
  2⤵
  PID:6760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3084133827634870009,9213865945157819901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  PID:6920

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3916

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f33785a7fd12b80cc9c7e6c1e7e619fc15ef40dd5dc9f7653216fec80cc19ac2
MD5 66fecd84c82f67b578f7bddba718b164
SHA1 2334c0936bd9885b14c2e48a31d6c8a854272f64
SHA512 038961238fbb20e06bc56b63d8cac5cac6f96b36781c7ee102bec75da613ff618442a5b2cdc8c2103317244d5e06e6e4edb4c1f247cf00edd7d971d1a5a9e000
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9de12fe07defd4340ff838c0a060c8c994e5f07527ff0d9971eb735fe2799c02
MD5 967863de4a654ae77525f194cd173bc1
SHA1 5ac9ddded8952002468f9766b50e280ee32ee24a
SHA512 506dad5944216ec64520b1d1a9ef168e4b3c642a341fc62b1508b910d3fc64f99eba8fd98d0bacb44cff95ef87dfdc1826897d2fa5618863143374514f4f5e4f
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 37KB
SHA256 28f495a706bbb9a09ca286ecba0123bde6bb8e1e0aece749eeea7c8d62fd52f7
MD5 472ec32677a453af2c74692a60147dad
SHA1 d88b5e900d82c9bdac5cecdc1104ae46888f9e89
SHA512 4140bdd439121c889e8ca3824b2aa6783318d0ed28557ad18ec8469df1cbcfa4b492f37b27124f3ec12300e3e32247bc1bd3aa9e89936228e6fba84e975beea0
SSDEEP 768:NE5yHWwPUBUMujBI1tJSksYBF/h3LM+jkcNnpiqwT8n8F:W028jzI8SZ3IudNpiqMPF
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Size 28KB
SHA256 776198e51a720d00e6fbdf21dc6595f02c3567ac572cdc33d59c77983f6551f9
MD5 4aadb2baab3e3281f196310a81b265ae
SHA1 dfec2e7f89bdfa61d75017b4f841778959ca281e
SHA512 1d7d768c85cc1aff3f9a89a61e898acf449b229302cc483becb71641aebb0804f4a86a250c4c4111e4ecbc5bfc750e8156743bbc00f4a0f54fe38a8a2a1c2d52
SSDEEP 768:b1zDd+axfaNRrcAHOjx06QRN4kmbieBilwRJkq:xzDcaxOxzHOjQRCkmueEwRJkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7f11828c543b17dc3f931836dde96cdb32918074730d974012f78670b1b18281
MD5 0c74643dc5064a62b0b9939d46ac1ed8
SHA1 7081b4dadb0584ecc6754f00a4faa0e1fa8cede3
SHA512 d953a2171269201dcbf2d1429f7da93333491c89ee44c8f407939a1d36dc2ed7e5a31049235dd16cff83606168b79379fa93a8546c7106dafbaf86667e05c213
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a0443f643913f685b0d6b62d3e9d6d1092fcf38265548881b6fbdeb2c5759913
MD5 c8375050b100209f1db903f6b2aaec5a
SHA1 9438b08bb0827d71ecdc2e02c14e56bc3a0d4b0b
SHA512 d135b38624b0bfbb35133d5baaa1b0cb91daf279b2816c8360ea2810f6caed1d1c7b406293fd03162ffc3d40b6c266d7ee5c0bcf29cf8feabbe1d49a9909b153
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 211d15fc4e29f50f310b056ab47473168bd1d1b2916b8df660cae750bb5adb67
MD5 4f01f7d21b7892df4ab6b2477e509b68
SHA1 f8be4dc7dd03bb60793db3dff3c4139f325eb3e1
SHA512 9792029f1cc292a08d86ebb2a17dc1d45402579617ec3857252b2bf51609c799ccbc2eeaed2d08d8bba1a683c6faba3e728ab37bbca6c7dfd784e2132be543fe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 50f5613e9acac9bc67459f154415d36d5cca4d4be3fde04fee95ba0f1fc15690
MD5 7b0284194ab7bf4573193394de0d82f2
SHA1 2773d243792a8782180d4c97b2a72f13bd328c1a
SHA512 6a4a88c9eaa7c82791107cc2658c9ddd0e6f1a9b52020db342eeab87ef539b27a24bf7335f7ea67cad470a627b6c11dc7fa54aa86e98416b244897073f6b156f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c3f61010fd558a761fbc1438fc9f2ea8424e07f0185226395deb6a3a9be0fe7a
MD5 5a512b910a1042784768dd4d253e3857
SHA1 e4924056deebe63f6a0f6970ec9e48630ab272a0
SHA512 e43e40a12802eb2a716fb5424c768e83973d3289877fae60176de2e4cfb2353ada4215a26b76cd2760259c245c90948e0f5f5420f378cb8605cdc7597cdf005e
SSDEEP 96:ntkjxm/pQYmqH1/T2wpvWMoiVmdeHk4clUWQyV+VDCziEwb:ntkQCUVT2GWMX+lro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8f4d5f5714d580d862a264cf305176318d72e3b84c3bce6e5e060608e41431c6
MD5 a53be442ee87ee192724f18e6d7e2e86
SHA1 dd85da5f40567fa2cd0231d070eba82e88b9cf49
SHA512 2d7f08f1783f22cfd87d2a97a0fe3785352892e729e67a61cd28aa5ff1092a0585a46138cd777318d08bc07e70a8abbea431824a3881e065c2206ceb9ebb0dd3
SSDEEP 96:ntkjxm/p1mqH13jN2wpkqLWMoiqR5mdeguZ1N4uaY1jkrXclUWQyV+VD7AiEwb:ntkQGURjN2ELWMqyuZ74uaYhQslrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f1c230f6d064158989479f099236ac7b7d8a054c199a2040e77dd7b44849fa5a
MD5 7a67e6a31c5eae1cb7e8ea4242c3abd9
SHA1 19f9ca557d106c93ab79e21273b0d466723ccbde
SHA512 cb630ba6f301cef9ea934951ab9b0d6fa9a867f922f44ed0b42afd2b1c5605fcc89dd02411c06e49f394e89689d991ee870cc3a3292f38a97aa68511e86aa185
SSDEEP 96:ntkjxm/pYhmqH13jE2wpkqLWMoiqR5mdeguZ1N4uaY1aymhPktclUWQyV+VD7Aih:ntkQhURjE2ELWMqyuZ74uaYMymhplrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 64afb563fb41a86f01ee8334a31dde90793f8cd76c566da81ab6430f79987c75
MD5 3f875d034a35a5633381072c3a4293d3
SHA1 7a70115ae86fae1672046554234339aab556a5bd
SHA512 9eeaf62bfb1e525328e2c8a525bd242356cf2ab180b5fed1fe554519e12476d73fd5970d20aa5138646846d3382eaa95cd80920dff319d49d4771bb04af284dd
SSDEEP 96:ntkrsQxxm/pYhmqH13jJ2wpkqLWMoiqRNR5mde8ecTR4uaY1aymhPkiIlUWQyV+/:ntkAhURjJ2ELWMqz6ec14uaYMymhWlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9bab1ed6fff387937096109bd09aeee1cdc14dd99a7f92536ec63be263494b6a
MD5 2905ed09483388b89143fc7682a0c830
SHA1 316b9be570668275106916923edcc8b320853805
SHA512 38bd20ecd5bc09ff419c0f6ff3b9693b17b9d8b8cac393d8964c0c8489de47fe8f3c6fd7670e4d030f41eb11697f0989ee24b4b1f13e90042028c2f180167040
SSDEEP 96:ntkjxm/pnmqH1/72wpvWMoiVmdeguZ1jknclUWQyV+VD7AiEwb:ntkQwUV72GWMwuZhXlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 05a006d5709ba452031a29444dad7ec3152de72515e712870d26aa033fe78d6f
MD5 54f0a9009d9b9830c6c014a36b6be9ed
SHA1 61a8c418694db4e3055c09af5f2d97df9e96b3d5
SHA512 b5f9ff8c6909e831352f41c60d8c9787393ee31b91a385c865244e90024cfda65873ed1e57738067e22e2e584fb53b5dec5d6d1d9fc60bad28fefef434c3cf04
SSDEEP 96:ntkjxm/pZmqH13jq2wp0OKWMoiVmdeguZ1N4uaY1jkrXclUWQyV+VD7AiEwb:ntkQyURjq2nOKWMwuZ74uaYhQslrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 637bbd2df5f3c01212276c363b4cb517b9c13fe9b37e73f85d8d4c2231c04f6d
MD5 2e1bb7955c584af97f3620cdfc33103f
SHA1 04fa840eb21481e2e9c1fa420bf68ad107279f38
SHA512 b7bb80f45a2ae1526833bdd01ef027d1d617d9126b3df4346873a9cbbe888b3469822b6b1aafc4c5f5e14b0342d5d3b4a5c3b626eea60d93eab6755431df5d7f
SSDEEP 96:ntk8sQxxm/pYhmqH13j32wpkqLWMoiqR5mdeguZ1N4uaY1aymhPktclUWQyV+VDp:ntk5hURj32ELWMqyuZ74uaYMymhplrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c3450af8ba0a66c564300cd6b28057041787899b889957c23f7b28e28041ad54
MD5 44b7351b48cd2e3fee45a8d20c27e10b
SHA1 5e5ea6e49881be7bb27749661113da95fc7f195b
SHA512 c15012e685afea1baf5a26d7f85d37180c99d1bebc2f852e52c6fef1b9fdf2e17c3e3e84bfc16a4eaa63cbd455fbe0ed28a112451d49a5943f5c7e46b4ca3c70
SSDEEP 192:ntk5hURjJ2ELWMqz+7M/N4uaYMymhulrg:ntpRjJrW/r0UO
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 37410b7b229dd6fb9cac60bdd0fd72d7d2796276ec9af9eaf6f22dde70fa7d73
MD5 313087b312e0a903b258403efc8e5818
SHA1 2d65031615294966729d7b54cc6d3e563dfe6e87
SHA512 a3a763be3834aec3c98149c3fe9533e9e9dad04c8b4d3c22555a173ac2bc0d9b0cd943c2bf1b1c4b95548824249bd9b3110f2f876e6b4cd7e1da7a808352c001
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 ba94fc179c25a68f63b9c1dcd0af5dae2e40fbac3d492be913a5ca6625cd9252
MD5 986e851ca9285fc948319173c70c330a
SHA1 0dc573ca1489bc4805c004005fe67554fb62e4b9
SHA512 927228071c4ffe82b840c0b4664ed527bcfd773e8d0842e640dbbd6d09acc3b81d292d70d097fd49a35f259ad9d0e8944ce0b5594c5c80f88655ddf105c9e241
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 0763ce93bdd8996bc02ee5b9c088be2f399e970a4a8e9be9c2f8918420348cbc
MD5 bea76c25d1d9bdf2a583b556c654941c
SHA1 8d53d54ee642ddae4dccd02b79761629ff4b34ad
SHA512 40b03bea8dfbdf3e2e7b8d750e641af502232f68dd0fa0f54b2953222f6c31d1597a79e2589771999e5f4b8b5e1dd553ee9d85c6aabb5bf7cfe282f5b017b325
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1d86feed470a9940fd1c5cd5f7468f3bfb9ecc3e239a51bc9d938541fdd79f4a
MD5 8a10539509e5cdd5847318cebb7b2711
SHA1 a8141a5dafc60ce67a2e6f54dd0f3f4f8a592886
SHA512 c5efcded89025705f076d95b85eb01e2232b951170375b9186bf8a012265058909e4f55c6f3b977d023a187b02ff8b1f7b2aaaf8cbc8cec18ff3f4c28b029230
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4f31bea0de957c24baed4553ea31a3f7cf693339cb3a71b2b73461f7612c5b9e
MD5 a618469f146359a15f2e2c8041f1863c
SHA1 4df6ef93a0121c0f3c397151b298c01c1d3ff048
SHA512 82cf85a004f44801dacac88cb7e235d6ded480a331cbf30d75d664ba8238a8f83b0380ae5f8b874613705c1cff06dd04b6ee675810cc505bcbfb97dce4aa5dea
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 f61871da005025b192302e31c058877d9e3deeff3496d01a3348886adaacfeff
MD5 e80d2ce265d7f0a9311c907a7a616a3c
SHA1 670c338fc035acf6ffd56fba3970bdf56a8efe2e
SHA512 44ba3aa70e8be44848b93ab3523f7c91f94d698c87c4a3dfb647bbf5447f11baf7aff7dd5f63eeba5f692384d7416cb832d7bcb63e0546ddb642e9b525d3c2eb
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 fec21f997d04d04c76d537dbd4111f29cd5c807b72ecfaf61e56cecb9094cc17
MD5 67dceecfdf9a25e7b5b8b883949e2ac5
SHA1 d7436d3458d60eca912b1fed2933b9a8d10d9d1e
SHA512 e5d182dff940f26a87ac32b8788ec369e3823813e459eeb22685f8d5668623df39aded8a8e68a030f6dbce58d954bc6efe98d4198847e14bcfe9273d6bcae116
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 89acb649e9d220f02b3cef1fff92365cbbeb5bf0e3129fbd84334360224f495e
MD5 3f96726342abcd5e8880da6488b7f553
SHA1 60d5f329d272bd98c4fe545cb4fb638d5296dc9f
SHA512 741616d3c699e2ea3a2b39cff913f6db66a5665807a6eeb80cba28d2f2ccf01af7cd8da9cd6101d9a41dd90c4ee5302afce461e776e8cb3db79fcdb94fe6b6eb
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b9bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9bb.TMP
Size 203B
SHA256 a918bbb18aa1efd910b828d9616d2d95a4bf8a513cff9b901db3ac410389de87
MD5 1a17e845df44eb58fbc1aee0470d4631
SHA1 ceb9cfa82db530703d938b2ab408e4f60361fc26
SHA512 9769d2a88438f27212a35fd2c2ebf2be4fb372e16174c8575731e5eca17f6b2836fde3c39157442174c1266a2232b4deb8be3b66c035d2db6ee35672253be35a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 09990498e8096873dd5e95bd85a25cf07f755a550c30d31f27444930c4487ae2
MD5 35af92807a9ae45b232a563bb283eba2
SHA1 464bf399cb8e985d4b4e2bb65207f911bcc91897
SHA512 4aa6cd5559f23503f5f1b2808c114a8cacabcda758caa4f0f3513904b037deb05720675a0b21916df5416f4bf6bddc2a6010f668f777c9790bd13e4ef6c246ad
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ke2RU7Zy4VE+OblfBhD0:A9iIxuERzA83h09RZxYj3uE/XDafSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3477da35ce863f87f9f00aef4dbddb86c4a6af244cf65e8e7ae5aeeaf4d4e997
MD5 64d1545ce1f238c2ad0ee2b675ee55b4
SHA1 63a3f2c2d69ba2a03f2c9a0d671a644e9f94906b
SHA512 f0e0046a382e68eb853400c2f6efbdfd64eaf86e27ab392e5b895f886eb28448abc0cfe20b449b2cd576d39aba59637d419673ad71345bd3f71ae0dbc2d0ac8d
SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ul2RU7NLo40B+OblfBhv:W9iIxuERzA83h09RZxYjKrB/XDafJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3a94c228cc52153f9ec30384d12c677c62791721eb5c4bce3c8bcc1ba2732943
MD5 a231e0be42ec12be328c9773af568caa
SHA1 3fbe4c5f5c604b347fdbe862099170d97a33a368
SHA512 f32c71a9da413a6cc7193d84c53200756818af0d9e07658ebd15436e4c391f67df942d9ed95af705a239cb8178eccee5fe46d64feaeffe44d8db95ada5035e35
SSDEEP 192:xoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ul2RU7FLo4Vm+OblfBhg:t9iIxuERzA83h09RZxYjKam/XDafSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 23675946a7ef8affb9cf90a7903b0b88567fc058e8b965dc95c5d076c946518e
MD5 ef787bd1c0f9957b3feb9cc2161aaec5
SHA1 9fd7539bd789feb0bb074b0cacf23ff5e75790e1
SHA512 a276ffd3644f1a4c695c6ea87e980e59b2e23f7adb4858a7430c259dfd64fd60fb30f17e70e167b17077180ec7b0f4e8f0010f071eb0c739a066e0d0392848dd
SSDEEP 192:MoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ul2RU7FLo4V4+OblfBhg:89iIxuERzA83h09RZxYjKa4/XDafSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 38b568ca55e31760a5b4f1bc5457fe0f8aacd73760061dce8d3908ffd18d4580
MD5 31297200c569b19d69ecb9b8abb3c44f
SHA1 03af048b5d541131e7954205d4d6f783940952ac
SHA512 237fc4d21ac53e8d593240ca410639e633808dcfb33ceffcb6404ba95662295735cb1a1211230ba8e891be1b49fb5e72309f00c4869a79f09bf16f82e8a89e7c
SSDEEP 192:qoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ul2RU7FLo4V4+OblfBhg:u9iIxuERzA83h09RZxYjKa4/XDafSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

e97c4998-3691-4109-94d3-da09dccfd7e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e97c4998-3691-4109-94d3-da09dccfd7e2.tmp
Size 12KB
SHA256 996ec6da6dd8d7a33eb1644d42b30fdd3cb26fc3d6f2676aaeaa3db3e7104fcd
MD5 dbd6e73329e86cb7d524f9baf6b2eff7
SHA1 5699df032956afd595dfd5d042234baf4b9625ab
SHA512 2e9d9061482d7d6b104b76830f1d68ce00a077f1b0ad7f894249f6265757b1fdd16f3c070e8ca275126ba9199d338ddbb0950128bc570a3794777ae4b3d04435
SSDEEP 192:CoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupj0ul2RU7FLo4Vm+OblfBhg:W9iIxuERzA83h09RZxYjKam/XDafSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2DF4.tmp\LangDLL.dll
Size 8KB
SHA256 f9075791123be825d521525377f340b0f811e55dcec00d0e8d0347f14733f8a3
MD5 59888d7d17f0100e5cffe2aca0b3dfaf
SHA1 8563187a53d22f33b90260819624943204924fdc
SHA512 d4ca43a00c689fa3204ce859fdd56cf47f92c10ba5cfa93bb987908a072364685b757c85febc11f8b3f869f413b07c6fcc8c3a3c81c9b5de3fba30d35495ff23
SSDEEP 96:NtrTcnv5RhqRIwfIis6o6bOl8MNysjgdKXSY7Jemv6ZwMDaH71pj:PHKxqFfzs6o5l2hKXSR6Xj
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2DF4.tmp\System.dll
Size 25KB
SHA256 f2bb03ddaeb75b17a006bc7fc652730d09a88d62861c2681a14ab2a21ef597ce
MD5 480304643eee06e32bfc0ff7e922c5b2
SHA1 383c23b3aba0450416b9fe60e77663ee96bb8359
SHA512 125c8d2ccbfd5e123ce680b689ac7a2452f2d14c5bfbb48385d64e24b28b6de97b53916c383945f2ff8d4528fef115fbb0b45a43ffa4579199e16d1004cf1642
SSDEEP 384:aZyRQ9dweQ9XYD/isN7lCEjgw4U/ktKi+RIcq1uCJOz3cDv+doYD:aR9dYIrx7lC7TU/kaG1uCJ43cb
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy2DF4.tmp\nsDialogs.dll
Size 14KB
SHA256 46b59010064c703fbaf22b0dbafadb5bd82ab5399f8b4badcc9eeda9329dbab8
MD5 990eb444cf524aa6e436295d5fc1d671
SHA1 ae599a54c0d3d57a2f8443ad7fc14a28fe26cac3
SHA512 d1e4eb477c90803ddf07d75f5d94c2dacfdcd3e786a74ea7c521401e116abf036d9399e467d2d12bd1a7c1abda2f1d6d15b40c8039fd6ec79ba5fe4119674c27
SSDEEP 192:+yWhF6MuqMgndPvg/YWkNLiY8vSKXS6Hn5gIIblaks89HAH9Edeqe4B0:zWh4MFvdw/YWCLXASKi6nAlbrAl4m
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf
MD5 7fba44cb533472c1e260d1f28892d86b
SHA1 727dce051fc511e000053952d568f77b538107bb
SHA512 1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70
MD5 b1c8aa9861b461806c9e738511edd6ae
SHA1 fe13c1bbc7e323845cbe6a1bb89259cbd05595f8
SHA512 841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
MD5 7d3d11283370585b060d50a12715851a
SHA1 3a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3
SHA512 a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a
MD5 63b1bb87284efe954e1c3ae390e7ee44
SHA1 75b297779e1e2a8009276dd8df4507eb57e4e179
SHA512 f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 eaec709a98b57cd9c054a205f9bfa76c7424db2845c077822804f31e16ac134c
MD5 c58234a092f9d899f0a623e28a4ab9db
SHA1 7398261b70453661c8b84df12e2bde7cbc07474b
SHA512 ae2724fc45a8d9d26e43d86bcc7e20f398d8ab4e251e89550087ace1311c4d2571392f2f0bed78da211fcb28766779c1853b80742faa69f722b2c44c283569fd
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 27KB
SHA256 f754f8a5456df5eaacb848838982d8494834fb7bbc5a28abc3551f4d6cf6ddd5
MD5 400acddb8ca6ac20213ea6e02791e58b
SHA1 f7e1568c26c896578eb9e588666f4b29d4553c8a
SHA512 0588d5bdd603cdedf7c1db6b32fcc3a4006cfb4ce8e5fe2ac031095a99a6d6fffc2e10facfa0fd547642e76baf2e4530b62a1d42cd522b86d06a3d31af767589
SSDEEP 768:3M8WF7ny4644C4iq4M4X4v434p4M4Z4x4+M4U:3MXt
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 d3cc40072173aefd83af77f24628e6763c291925aad472a6dc793fc0ea378c77
MD5 c596f12771625bca4fdaa5cc141e584c
SHA1 4cf0caffe9dad1f190b6824e42554894e8527be1
SHA512 5d8cd7a5ef46e6625e5d45b313b54ada4dd187014e64864a44a1f9b76815e176c3640159476518a62cf8a19243168bf8e19dec856dae56321f923e9520495a11
SSDEEP 96:xHrTeqGqJtczvzJzfzfZWPEnj82XkjyuepKIx59YuaiMNBw8MBQ5jUncGS:HRJtInjZ5gIxnYuaJNBw8MUjMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 fa738492c911f8e38e8802a8f1d439e182b35ffbe02e202607dc77555fe19884
MD5 658546ca897483cb0c8f261ea5ad1628
SHA1 0d2c4070eed406d98cfb0baa72f0e705fafcd5c3
SHA512 4c4bd09b124875323e65dc6e949c352a254cd152003c3f41d966f17762d7f6db229a2c40b2c81a52630d30b8f1432b7810510273123fb84a2ba9064c3c64bd1e
SSDEEP 96:xHWTeqGqTtbzvzJzfzfZWPEnj82XkjSWepKIx5DCBw8H8:oRTtXnjxRgIx9CBw8H8
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 d8b681408f89bde860729b7f3afab3f60537c2df2987cd124c85f50a074e50e1
MD5 c4c32c2acbe3fbe92119e10306d0fd0b
SHA1 c912a8f2700a1e949fbf95411f00aefd12aeea8f
SHA512 efe82f735352725f744080366059cbe50a6b9ffb4ae28f8de63bbbed9ff92e0f7ac7a58a30a2cb8943ac68e3c15ca2d3ae5314eeaa9c19e068600b3bc1e49931
SSDEEP 96:xHrTeqGqJtbzvzJzfzfZWPEnj82XkjSWepKIx5DCBw8M9Qk:HRJtXnjxRgIx9CBw8M7
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 2b207386ee45267dd48a0182806d36f4e746ebf0ddff3557f5580bd0eec6c103
MD5 14cbf73feb5dab6cd5c877159ec0c419
SHA1 4253df2fa384469d0bba505301dd8886af66585d
SHA512 681b50ad05ab75d04f1d446789c0ddcb958692790803b50cb56e4855b595b2a1d425b15009a56253d9eb1461530a5d4072ed9f8f3fc8a9d374b1fe38354f7120
SSDEEP 96:xHrTeqGqJtczvzJzfzfZWPEnj82XkjyWepKIx59YuaiMNBw8MBQk:HRJtInjZRgIxnYuaJNBw8MX
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 2KB
SHA256 2513746c5f070974bbea9218e56631a5e311e350ec0f92d8337234a5973efd8c
MD5 267ddac7c97b694730273b837db9a5c8
SHA1 23835997a33a2fc5392dc45e5a38dfcbea7f2573
SHA512 52d532543005250afd1d3d105fbc6523ad1b617b69b3a296942bf388a78f1ec3ec8df2ccb548d6b41e1f4ac0a228fa63de1923e002eeec9c448252107d5924d6
MD5 SHA1 SHA512

Submit Download

cached-descriptors.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-descriptors.new
Size 14KB
SHA256 b84bc63e593834f959eb38bd0852b19628074c48bc220c4d9ff52bed83ec0b07
MD5 8bce8297e1563517d142cdc3360993a2
SHA1 15ddcfb8ba13b836cc76cfeebb9a91d343ec6e9c
SHA512 c539cab5426411ec36efb99ae85cfdf2458063f92715b2eca94ac87daa4d279ff0ceee2876127e88ad2e9a09e686176c15b1ba0b914acdc94aea967ab7ae36af
SSDEEP 384:Xhbqq2jdUkehz/OhyhVV4DTJUCehc/khSihx18j7UxehhB/vhhThDg2O917UsfhZ:3/E1SmLaNfPRDsT4eaEGn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
Size 2.5MB
SHA256 812530fd4b0089e6ab6449a5879905ddd22e8c7b5d63a8308b7ae0414892d308
MD5 2e9f6bb51385db689fb9124a3a801de2
SHA1 5e2e49df47e9cb3af578aa97b5175d88f0387571
SHA512 719cbf50b98c0da7fce2fe8778bddcb32bce8c9457e544cfef88ee4c1f43edc5c2870e8d960142b4686890d7139576fbbe0dfcb750d96f5ed505720d7f264cb3
SSDEEP 12288:DvAHEb/vkRQXEwOKSS/NcaOEc/BGbWxMADq/4k22Q82TJp:DIkMQbXOPGbEMmI223ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
Size 5.8MB
SHA256 b1e71bab7456ad9594a2e602c64902a713541e67dd7d55c3b0e52bd53f0211f4
MD5 2262a8ed24363a02f772c2739fb55b24
SHA1 6470e77b0c7d577748830ef07d4f5ce28d0b844a
SHA512 0d855b6081d43a791383a496a6ea94f979ee7cab1a705679dcfc2546aac3a2c1ba7d6b7a618767bcb8ac48a90cf7822398549c8070bd8dfb7f41c4a1685f1b01
SSDEEP 24576:9U2EeI8+/czBhAXxof+V1sXR4IphZ3dTNTO1/yOv32AeSZXdxiZhGpxZ3awQTZr/:/XZAN4w0t3Fp
MD5 SHA1 SHA512 SSDEEP

Submit Download

torrc

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc
Size 511B
SHA256 643450c19b590a7cd98ae0b2ad39dc99d721da737a9c64300e1e671e7e1b4fb3
MD5 ad2d90351718f4617d04bda0c7fb77ce
SHA1 9d1beb30e95f48a24748c41371de64c2ad117825
SHA512 8bd399ff10836bb93285a95321d0ce97198c8bedecb6f2f5b92cf0e72db6f5fe38838afc24e1f0e4b5d0eeedce017bcbd0b16a203f6ec623d2378fd91719ac12
MD5 SHA1 SHA512

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 42B
SHA256 2b157d7ff7505d10cb5c3a7de9ba14a6832d1f5bfdbfe4fff981b5db394db6ce
MD5 70b1d09d91bc834e84a48a259f7c1ee9
SHA1 592ddaec59f760c0afe677ad3001f4b1a85bb3c0
SHA512 b37be03d875aa75df5a525f068ed6cf43970d38088d7d28ae100a51e2baa55c2ad5180be0beda2300406db0bdea231dde1d3394ee1c466c0230253edfe6aa6e4
MD5 SHA1 SHA512

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.7MB
SHA256 51b63860fd996d6d5b1753ba6bb7f3a4303f13187fbfecc96ba2b6bae52a7410
MD5 65aa9b0f57d72e4d70e9226322221adc
SHA1 85fec174d0977afd8c0100c9d9b53c958e1949bf
SHA512 f84416a5e9293b8b82993e9424b13d5bb8542d1a379d04f498b60f0b5805626b7c97bcc6f86f6cfd33031b0d65d0ad23ce6d836995b5a481ed29f62ef89b2c85
SSDEEP 24576:M7iOs4gKM8fqEneVGiiEOwaJwORKTCRj:MOOs4/qEneVG6LAwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 43KB
SHA256 8969747ecb7dfd4a6dcb9150017e14ebbf90ce558f6fb469f6b558d039e9259a
MD5 726abf1280adf3129481b94b2bc644c4
SHA1 404f69e71296f2d199535e8a6d9fb56707fcbc5f
SHA512 160b57aa1a28ff35210cf958fd7821aa2cc1cf6fca1ea38d768fa90111826b096518363b00b6818d21743aefd6bbbfa358fbe2fe3afa95edacb330a747c6e5f3
SSDEEP 768:BzOk3s6hvnS5YRtWFaEsCI40lLodavTqXGHvHa8mTOt:BX5hvnS5TPrJ3Ta
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 1.4MB
SHA256 eefcf97ee8a298c85c9d4d44bb8747c0cca1ef5922e25000814148fd0fbfb2f5
MD5 3e4d1ec1d2a6e85593459601b5a0a828
SHA1 92ee422285282dcb170cbc7808299d14d8d27963
SHA512 4fe70fdbf8c902497537fbcda6e96373c636521aba2db52e3047abad37a9b857ab1668f203bcdf2815bbe0c485ec751dd6031043f459fd4af968c5d495e44ba4
SSDEEP 24576:Amh4168eo08mGAvbfjZSS5Z+KFB6B2q1xWF8qRLCUQFZD:1hKd0fGA4m7FB+2cWF8qRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.5MB
SHA256 6e69c7c93a9d06c34c5f5429813d3763fe7ae4fb09c1dc5b0f0290b2dd8befcf
MD5 71747091d34cc634b9ad3c360b45b0a9
SHA1 111cf483836f6a392f64bc9398a327be1c43dfc8
SHA512 b911fd3b201a84c7663135c2dbf72e2368d68557181f5e1a32be271b0e73181f34990575fba44002fc92bae7d90caf530b7ec9212d3d022b4526906f0c2eb35a
SSDEEP 49152:1euOpyLD3FhJFQ9+gXjQsARS7eL+x/uYA/KJZWlWYgLRXvpoLQTVHRNhYL9ftMS0:1euOwLD1TegbqmcygFFlhYLPMS1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Start Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Start Tor Browser.lnk
Size 829B
SHA256 b0288a9d21cebd5f1029ce2890c0e251575ba385ffb0541c94ad6b865b6cbfc5
MD5 f39c8a118213e83556d5cd4007f72cae
SHA1 0849e5ec9b1f3c2264e09bc97ba6b767d1808aff
SHA512 d50f68ceac6649bc4f8b726f31c23a6a740e150bd081fc4f7c4aa7ac279a1bc3dd188b119807a152415c2f240507e1b4cd94dcb74293e92d016ac0c0a53c0b87
MD5 SHA1 SHA512

Submit Download

memory/2420-1460-0x000002067B900000-0x000002067B9CD000-memory.dmp

Download

memory/4176-1420-0x0000027E5CE30000-0x0000027E5CEFD000-memory.dmp

Download

memory/4176-1229-0x00007FFD7D430000-0x00007FFD7D431000-memory.dmp

Download

memory/4176-1228-0x00007FFD7F2A0000-0x00007FFD7F2A1000-memory.dmp

Download

memory/5284-1342-0x000001BF86E60000-0x000001BF86E70000-memory.dmp

Download

memory/5284-1434-0x000001BFFB960000-0x000001BFFBAD0000-memory.dmp

Download

memory/5284-1247-0x000001BF83D70000-0x000001BF83D80000-memory.dmp

Download

memory/5548-1457-0x00000201E5D40000-0x00000201E5E0D000-memory.dmp

Download

memory/5668-1458-0x000001EF80000000-0x000001EF800CD000-memory.dmp

Download

memory/5888-1459-0x00000220BF000000-0x00000220BF0CD000-memory.dmp

Download

memory/5976-1132-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/5976-1077-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/5976-909-0x00007FFD74660000-0x00007FFD7466F000-memory.dmp

Download

memory/5976-908-0x0000000140000000-0x0000000140070000-memory.dmp

Download

memory/5976-1079-0x00007FFD71690000-0x00007FFD7169D000-memory.dmp

Download

memory/5976-1456-0x000001B313780000-0x000001B31384D000-memory.dmp

Download