Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
500s -
max time network
502s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 12:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/kh4sh3i/Ransomware-Samples
Resource
win10v2004-20240611-en
General
-
Target
https://github.com/kh4sh3i/Ransomware-Samples
Malware Config
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___D4F8OFCW_.txt
cerber
http://p27dokhpz2n7nvgr.onion/8A9D-069A-1384-0446-93BE
http://p27dokhpz2n7nvgr.12hygy.top/8A9D-069A-1384-0446-93BE
http://p27dokhpz2n7nvgr.14ewqv.top/8A9D-069A-1384-0446-93BE
http://p27dokhpz2n7nvgr.14vvrc.top/8A9D-069A-1384-0446-93BE
http://p27dokhpz2n7nvgr.129p1t.top/8A9D-069A-1384-0446-93BE
http://p27dokhpz2n7nvgr.1apgrn.top/8A9D-069A-1384-0446-93BE
Extracted
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___4OM3_.hta
cerber
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Contacts a large (1133) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4484 netsh.exe 5000 netsh.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation firefox.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation firefox.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation tor-browser-windows-x86_64-portable-13.5.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation firefox.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation firefox.exe Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation firefox.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\word\startup\ cerber.exe -
Executes dropped EXE 24 IoCs
pid Process 5236 tor-browser-windows-x86_64-portable-13.5.exe 5860 firefox.exe 3752 firefox.exe 2284 firefox.exe 5836 firefox.exe 4828 tor.exe 1304 firefox.exe 1172 firefox.exe 6288 firefox.exe 6204 firefox.exe 6260 firefox.exe 6404 firefox.exe 6916 firefox.exe 5568 firefox.exe 7064 firefox.exe 5780 firefox.exe 6540 firefox.exe 7076 tor.exe 7128 firefox.exe 6980 firefox.exe 964 firefox.exe 1124 firefox.exe 7124 firefox.exe 6408 firefox.exe -
Loads dropped DLL 64 IoCs
pid Process 5236 tor-browser-windows-x86_64-portable-13.5.exe 5236 tor-browser-windows-x86_64-portable-13.5.exe 5236 tor-browser-windows-x86_64-portable-13.5.exe 5860 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 3752 firefox.exe 2284 firefox.exe 2284 firefox.exe 2284 firefox.exe 2284 firefox.exe 5836 firefox.exe 5836 firefox.exe 5836 firefox.exe 5836 firefox.exe 1304 firefox.exe 1172 firefox.exe 1304 firefox.exe 1304 firefox.exe 1304 firefox.exe 1172 firefox.exe 1172 firefox.exe 1172 firefox.exe 5836 firefox.exe 5836 firefox.exe 6288 firefox.exe 6288 firefox.exe 6288 firefox.exe 6288 firefox.exe 6288 firefox.exe 6288 firefox.exe 1172 firefox.exe 1172 firefox.exe 1304 firefox.exe 1304 firefox.exe 6204 firefox.exe 6204 firefox.exe 6204 firefox.exe 6204 firefox.exe 6260 firefox.exe 6260 firefox.exe 6260 firefox.exe 6260 firefox.exe 6404 firefox.exe 6404 firefox.exe 6404 firefox.exe 6404 firefox.exe 6204 firefox.exe 6204 firefox.exe 6260 firefox.exe 6260 firefox.exe 6404 firefox.exe 6404 firefox.exe 6916 firefox.exe 6916 firefox.exe 6916 firefox.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA firefox.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA firefox.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 29 raw.githubusercontent.com 31 raw.githubusercontent.com 69 raw.githubusercontent.com -
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! cerber.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents cerber.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpAC8D.bmp" cerber.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File opened for modification \??\c:\program files (x86)\microsoft sql server cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote cerber.exe File opened for modification \??\c:\program files (x86)\onenote cerber.exe File opened for modification \??\c:\program files (x86)\powerpoint cerber.exe File opened for modification \??\c:\program files (x86)\thunderbird cerber.exe File opened for modification \??\c:\program files\ cerber.exe File opened for modification \??\c:\program files (x86)\excel cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\office cerber.exe File opened for modification \??\c:\program files (x86)\office cerber.exe File opened for modification \??\c:\program files (x86)\outlook cerber.exe File opened for modification \??\c:\program files (x86)\steam cerber.exe File opened for modification \??\c:\program files (x86)\ cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint cerber.exe File opened for modification \??\c:\program files (x86)\bitcoin cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\word cerber.exe File opened for modification \??\c:\program files (x86)\the bat! cerber.exe File opened for modification \??\c:\program files (x86)\word cerber.exe File opened for modification \??\c:\program files (x86)\microsoft\excel cerber.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\thunderbird cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\the bat! cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\thunderbird cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop cerber.exe File opened for modification \??\c:\windows\ cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint cerber.exe File opened for modification C:\Windows\SysWOW64 cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\outlook cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\onenote cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\steam cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word cerber.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook cerber.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server cerber.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
pid Process 3616 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637914159436783" chrome.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings cerber.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ tor-browser-windows-x86_64-portable-13.5.exe Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings firefox.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.exe:Zone.Identifier firefox.exe -
Opens file in notepad (likely ransom note) 2 IoCs
pid Process 2240 NOTEPAD.EXE 6180 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1188 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 3168 chrome.exe 3168 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe Token: SeShutdownPrivilege 4544 chrome.exe Token: SeCreatePagefilePrivilege 4544 chrome.exe -
Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 3752 firefox.exe 5780 firefox.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 4544 chrome.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2412 OpenWith.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 2712 firefox.exe 3752 firefox.exe 5780 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4544 wrote to memory of 2228 4544 chrome.exe 83 PID 4544 wrote to memory of 2228 4544 chrome.exe 83 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 4124 4544 chrome.exe 84 PID 4544 wrote to memory of 1892 4544 chrome.exe 85 PID 4544 wrote to memory of 1892 4544 chrome.exe 85 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 PID 4544 wrote to memory of 2592 4544 chrome.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15c7ab58,0x7ffd15c7ab68,0x7ffd15c7ab782⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:22⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:12⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:12⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4708 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:4864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1904,i,9184197726976733274,8220141299316214129,131072 /prefetch:82⤵PID:620
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2264
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1584
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2412
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cerber.zip\cerber.exe"1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2776 -
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4484
-
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5000
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___KQS1PL_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵PID:2692
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YQRGT_.txt2⤵
- Opens file in notepad (likely ransom note)
PID:2240
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:2804
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "cerber.exe"3⤵
- Kills process with taskkill
PID:3616
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
PID:1188
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵PID:4360
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2712 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.0.314116649\1410770549" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1768 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b901c2f4-f3d0-4a4d-97b5-a79e876d6945} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 1852 2406b50cf58 gpu3⤵PID:1512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.1.1026901038\1312049847" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dc3f0434-7918-46fa-97e3-ffcd5caa48db} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 2420 24057189f58 socket3⤵PID:4780
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.2.284371588\1413421294" -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 2968 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22903b18-c6ae-4b66-8d00-211dc5b88a30} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 2980 2406dde1e58 tab3⤵PID:3936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.3.2120177084\1030092607" -childID 2 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55024db9-7eb9-4c42-8269-87242f0bd246} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 3652 2407056a658 tab3⤵PID:796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.4.1182994689\361788944" -childID 3 -isForBrowser -prefsHandle 5108 -prefMapHandle 4304 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f39e14d7-17d1-49db-a650-b0e2febc7def} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 5112 2407214b658 tab3⤵PID:5156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.5.1636610090\143288811" -childID 4 -isForBrowser -prefsHandle 5260 -prefMapHandle 5264 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {236619ca-cfec-4170-bf8f-a350cd7e57c0} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 5248 24072c6ea58 tab3⤵PID:5164
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.6.1004052045\1523453491" -childID 5 -isForBrowser -prefsHandle 5452 -prefMapHandle 5456 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4a419fd-160d-497f-9740-964820f63064} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 5448 24072c6f958 tab3⤵PID:5172
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.7.49422565\899828284" -childID 6 -isForBrowser -prefsHandle 5280 -prefMapHandle 2792 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {162f9e57-23cb-49c7-8f4c-45bf78dc3cc5} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 5292 24070df1f58 tab3⤵PID:5532
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.8.1971800088\1075905169" -childID 7 -isForBrowser -prefsHandle 6252 -prefMapHandle 6248 -prefsLen 27776 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c3ffaf8-7d02-4aa8-bec4-1e91c9a16821} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 6260 24074a21458 tab3⤵PID:5980
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2712.9.569731205\324256072" -childID 8 -isForBrowser -prefsHandle 6212 -prefMapHandle 5412 -prefsLen 28041 -prefMapSize 235121 -jsInitHandle 1300 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1c51be9d-5713-4289-aa04-a9ac9c87121a} 2712 "\\.\pipe\gecko-crash-server-pipe.2712" 6160 2407361a858 tab3⤵PID:5908
-
-
-
C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.exe"C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5236 -
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5860 -
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3752 -
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.0.1598701598\1207266703" -parentBuildID 20240611120000 -prefsHandle 2764 -prefMapHandle 2756 -prefsLen 19245 -prefMapSize 240228 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {45c3587e-3b39-40a4-a186-58904ae219cc} 3752 gpu4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.1.533885942\1827117215" -childID 1 -isForBrowser -prefsHandle 2156 -prefMapHandle 1764 -prefsLen 20081 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {4f61b0e5-69ce-417f-9bc8-f0e29dc5eed8} 3752 tab4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5836
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:f5fffc56abf0f99d602a2a04310eb68a2bc6355d80dccd62948467182a +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 3752 DisableNetwork 14⤵
- Executes dropped EXE
PID:4828
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.2.1509298613\1316471605" -childID 2 -isForBrowser -prefsHandle 3408 -prefMapHandle 2208 -prefsLen 20893 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {76d409b2-9ba6-4b07-9b36-1d02e662c26b} 3752 tab4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.3.43959315\1053405611" -childID 3 -isForBrowser -prefsHandle 3244 -prefMapHandle 3380 -prefsLen 20970 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {94c2fa2b-c8f6-48c4-bf7b-ea4e53eb9e7d} 3752 tab4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.4.707369325\248207612" -parentBuildID 20240611120000 -prefsHandle 1720 -prefMapHandle 3328 -prefsLen 24174 -prefMapSize 240228 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {f79de4cf-9318-42eb-85b7-1f0981847e44} 3752 rdd4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6288
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.5.1689940316\585174093" -childID 4 -isForBrowser -prefsHandle 3176 -prefMapHandle 3108 -prefsLen 22491 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {12386602-7f0a-474a-9003-c818a37ab55e} 3752 tab4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6204
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.6.967290885\1644964838" -childID 5 -isForBrowser -prefsHandle 4064 -prefMapHandle 4060 -prefsLen 22491 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {9869e7f1-02c7-4e5a-806b-a6500bd518ab} 3752 tab4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:6260
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.7.2073573922\1282515895" -childID 6 -isForBrowser -prefsHandle 4424 -prefMapHandle 4428 -prefsLen 22491 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {30e5299f-dada-467e-b58f-22cb5d669f78} 3752 tab4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6404
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.8.1815261364\1929375317" -childID 7 -isForBrowser -prefsHandle 4764 -prefMapHandle 4760 -prefsLen 22614 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {13706f1b-f04b-4817-b5ce-3b6966ba21b8} 3752 tab4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6916
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3752.9.902238893\1084747525" -childID 8 -isForBrowser -prefsHandle 4204 -prefMapHandle 4200 -prefsLen 22989 -prefMapSize 240228 -jsInitHandle 1268 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {5969b74b-e9a4-4196-804c-34310337abfb} 3752 tab4⤵
- Executes dropped EXE
PID:5568
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YQRGT_.txt1⤵
- Opens file in notepad (likely ransom note)
PID:6180
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"1⤵
- Executes dropped EXE
PID:7064 -
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5780 -
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.0.138349930\1149177944" -parentBuildID 20240611120000 -prefsHandle 1884 -prefMapHandle 1868 -prefsLen 21673 -prefMapSize 241692 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {16d03982-cc61-486e-959d-0b3b3ba5fece} 5780 gpu3⤵
- Executes dropped EXE
PID:6540
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:a40c166011e4694c60f872d470c3d54a428f9ad03299a520e10c074209 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 5780 DisableNetwork 13⤵
- Executes dropped EXE
PID:7076
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.1.688198768\1784041398" -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 2792 -prefsLen 21747 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {3af440f0-f7f8-4825-b232-b78c01087081} 5780 tab3⤵
- Executes dropped EXE
PID:7128
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.2.921853254\1270524993" -childID 2 -isForBrowser -prefsHandle 3172 -prefMapHandle 3176 -prefsLen 21877 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {39eb0386-192c-4063-b05a-c5bdf002b2fe} 5780 tab3⤵
- Executes dropped EXE
PID:6980
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.3.335209863\301948741" -childID 3 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 20713 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {17895404-77b4-464d-8ae3-5b3fbdb6729d} 5780 tab3⤵
- Executes dropped EXE
PID:964
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.4.284770401\1267985546" -childID 4 -isForBrowser -prefsHandle 4020 -prefMapHandle 4024 -prefsLen 20713 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {74632e97-176f-4807-a41b-521c618186fc} 5780 tab3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1124
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.5.1102099108\84068797" -childID 5 -isForBrowser -prefsHandle 4220 -prefMapHandle 4224 -prefsLen 20713 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {fb0d9fa9-7d26-41e7-a2d6-2f7f9fc48e9f} 5780 tab3⤵
- Executes dropped EXE
PID:7124
-
-
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="5780.6.1982623251\959742763" -childID 6 -isForBrowser -prefsHandle 4052 -prefMapHandle 1828 -prefsLen 21225 -prefMapSize 241692 -jsInitHandle 1336 -jsInitLen 240916 -parentBuildID 20240611120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {c7b95b64-b1ba-4ee9-a533-a676410e7dbc} 5780 tab3⤵
- Executes dropped EXE
PID:6408
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD52f68d90da267ebb0cacf16a200add3f7
SHA1d246141eb575d54d6535451c9df2df25f240f426
SHA2568007bd0e2aef26451946dccbb7ec087c329ab94355baf784a6d25917c74dd9ef
SHA51270e9149199825ad6b31b60ec3595a2582b3aa8c1910c6fd0256728304959ff4c95fad74b356f1e99ccd40c9d2b6b1d74701cbb49c966e22ae2dd086220a8f334
-
Filesize
37KB
MD5669b1563b95fce26d9ddc3c7e9bdc538
SHA1275e4ae2606a0da908003b77ea06b24ea8b66214
SHA256d46765072d87d9892a0f6f8f9849eafe0abecee9d662e99f8b45d8c5b22ac667
SHA51209e066f5a1974927b2cb607a8b953f2732928c7347f65cdfcdb573170840562de6eae091a61108827b3ae0799c16bfbd41d858ee1a8bc57d9bb1fac814438302
-
Filesize
20KB
MD510931e6644261e0333a682d55db8125b
SHA113d50ed13f366c583219d8ebb758fae10e6e62a5
SHA256c6410eee37d64b5db1d6bc8df97b31db2a65237933fb41585d044d1960bfedaf
SHA512ea748be7c53ed7dd4925d350323bc33de97414d51a2fa21e8e048b3d250be24d44da6065ce19172a5b5a2810ba2ad62ef9ee5a7e797047401cc60e9b87f484f4
-
Filesize
36KB
MD501369d5062d49b270c8dd6ab535bc403
SHA139c654df64cd7386081da8108f23573f331debab
SHA256ed672ed37bfdadddb835de8c346655a17b653094197a2d6080e6777fa59785ea
SHA512de704934135717cb62e4d15ef1666e78b3d43c17ff5d50b279c21a5318ac2ce0cea88ebeb17b66f4668e1ca1a8801bdd6bab0194b157b1da6bd90c71b29da08e
-
Filesize
22KB
MD51ac27973084a93966f6a90d5b518e258
SHA1787986ea7a061e18e3d858c919a7692c6d100ed3
SHA256f8a4c49273653af8dff6bc5e910bdc5a4ca5496c60f0221cfbf3da26df2388f8
SHA5123bbd2a13f7583890c4730aa4fbe49bd1d280950e28917389177b6eddfdfaee6b1969efa3e4741c6ab21e9f83154540ed80652f3c1c9145fd2fa6a0687b6aa461
-
Filesize
3KB
MD52ff2645a211d1220b6f270c7c0fb114e
SHA12a2e98642fa8ed872f466dc9c3a9fb2aba5c7c78
SHA2561bf6517e371f8ebcc60dab518d89cf6302a45bb31bd87bc516a14d4e433779d1
SHA5127331fd01e90d2db27ce6d1fa8066238a1909045f26b6a15b394f6534d21feffcc2f12c77ca020f377cfd110846fdf0e4d0543ab31ab6c4b68c23cf1eaa6e78f4
-
Filesize
3KB
MD53c8ffdca2085e15c4619b94bd328dbda
SHA141fa0c80e2eff6ae22db2143ab4f6c281521be4e
SHA256fb15640e7a5c22dac2ee46201d2549baac66601c408d576b1d599e2327152e89
SHA5121291aed161a25e8dea19ee40d5851e4058e7df1fa9918c4e7cace7ff40f1747319eaa0ec9df57ba707946e29b7384c9c9f3bef141cdf33a76af2c7287bd8d9b8
-
Filesize
2KB
MD5bead1929c301ecd85e29c6c0a5bdd294
SHA1b041d42de0e620fdab05216216f944d5c39efb09
SHA256410edf1ab8c1b7598f4a20e396cd1c748135b644c40602bbe51959ffd25ece6d
SHA5125561575931d4fde2cb22c936fdf8f99690f156cca3efb5bf2c770be78e31590ba879970c240ff7dec1cba5932b44618243fad27e79e4c144ab00d8f6a35b4dc8
-
Filesize
2KB
MD5545b6b2d69d9b95d55e728b39e49e9c1
SHA12bd08ad37eb8136d276e1cfd63f3897059ebffad
SHA25616f9fcc8735a3837982b1dbe268a2dfc5af960bf81a6228812b2faea4dbc7095
SHA5122f6fb3f27b55989faf69cd783ce50b921004f72fc0f7bc1739c144f32a55215c46d260d9a416af8983d94df6d107c538da6e564140875c3baa0d7580a1942c15
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD56b25b7fcf6a47766d69f1ef85b4cb8a9
SHA1dec448ae4a3bd1eb80ec9d26c0bba4cdc84b4a66
SHA256cc7d7bd99b524e2940b3ecaa9dc6fb6ecad6c7f0df2ca5689b6dd7ac175e6aa6
SHA51216cd1a973c0e3c34bf60514eca643dcce783fc56eb847d1c8c378fa21e1b111d46d1ce3c40ae1c573d435c07b8ce03854014b7ef8af19193b95c22e7a1ad5f62
-
Filesize
1KB
MD5662e2499a4d9d2297fa13363ec468836
SHA113e796288e549263611d463236746859a5edc29e
SHA2561d269ac5c601473a270ff162028eae3ea66e18e4b29aa05dd17c76149bd220de
SHA5124bfef1f26d729bb6fbfcf9c8e706a601f7a9223cace56ca29b2e9c83c2277cb30ac95a4b71199df865717d4da97d53cf0ecd3eb296c8d822c09bdec385fcb0d1
-
Filesize
1KB
MD5b42ecbe217aabf4fdad91a425b554368
SHA1ff37151812f930e1f267dc1d163188fbb2b558d0
SHA25698ec0c5f41c165f8195fe923604392610e4a80d318c2b4946f00bf5189f2034a
SHA512cd709bfc60c4cdea8d652094ed75d2014493c1721e5f5f9f01cc5ed5780155f0ac5700a978e16586cc8a5ae16aacd30dba86722099162bfd10b3d3912efca2e3
-
Filesize
1KB
MD5d13e399d26c491ab378a7bd4d0d0a703
SHA117ffe1a4e01a9f2b73f5bb3f6319b806aecb2a3f
SHA2561ee92c007df57955072d841f084c3f22e0fd847a0bda4c6eb8792bd0d8c5c047
SHA512f232f325e68503f78099f3f6f6b4ba7d440eca260e15041097bf2dcb3bc3306360f017e3480578357b7eab6cd3ef25d8e2f77b4ebf3b83068529d3a894e25949
-
Filesize
1KB
MD5fd1eb3301bba40515a6100da28e0ecf9
SHA1e7e64ab3f793096ef5776288de1f3504e70e9de6
SHA256e8a065f9a0edf12682a9983c88cc851f3a4f7993318ff2f6ff0c0aa6e67781ec
SHA51216b48c1b27e4bb9e9e04f596c32c299ee24a13b0e6542bf8835ed7033db094e85acb7cc017fd9fa5dd0047c48e1793ece5ab35a09bf92722fda48cfb689eb7c8
-
Filesize
1KB
MD50bac3733919dbc5a20eb124ea4a7b58e
SHA1e40d2c06c8e02e357cff0456010c3e4c06e677a2
SHA256a02731081473e87946718259c8d26cdf018b6168ab63d4b16fbaf8ac7854b1dc
SHA512d892ca0e946feec05b92e5d76718c299ae3093f6311fdacdc55197fd235e23ac851cb29996622ff407107acb953e91e21cdb9fec31dec75f37b52a1ec81d0a85
-
Filesize
1KB
MD50c2aa38af1c5f340c567053dd3619c5e
SHA141a37f065dac61a87ba9f41e3f8336f4b9245200
SHA25674075b03a719bef24aab0915e8533c8728024c2e3e7c32e2ef06e0ff4563c660
SHA512237468ac12d2302408fe375f3fbe9db4f7b9b7a7c27ec9d7f0cd3f2bcc1a81c89b04bb54e1ac2546a59210a0ab8b23bf947bee0b7178bbea9134d46127ff7ab9
-
Filesize
1KB
MD502f276d5ebba623ed8af5a0f4e52a38c
SHA1d37ec4dd66f8fde3f570bc418dd499f401903c39
SHA256391018abe77768c48176a1c94c198681ceba028fbc72b54b3ee464c5e21249d0
SHA51276d71b60bb9f5b86b9f933a1121a5ab440fab6aefddb1ef123fae4fb62eaa4e9b8a392c530039092da83df713113006b13acecd14a878c3efb34daf4f79dc67f
-
Filesize
1KB
MD5bbee7f1895eac006e3c2b05f3d5c8b67
SHA1fc6e21aedbf81bd2d849458ed8732656fc00536a
SHA256f7be3f2593dc91e13e9d4d16f477f94426c8e537cab2d933ef0e04907a6cb6ed
SHA5120ce020996f3e225ed3512eddd3bdf47f651f90ab15c1be687990ad7e77df66ef33b4ca75fac3229890358821d8cf374812134bcb3f5f8eb5179931d430c8c53b
-
Filesize
1KB
MD5aacc0a71f0ba5ed956ccb3f76d711080
SHA1ce9c584babc1159db3d148cd1ab9aba7cbf3082c
SHA256755ee97f8962734fa33ce3494e02e89d14cc99f85ba8c20b6157732d12bb9e82
SHA512121508e625c03fba2c7ce5cac96f723c67dd10ab034ecb61df6b8973e85927301827a73a8e6ebb13a84e212c15e37db51e4440be19aceacba98e11ea0c453ba1
-
Filesize
1KB
MD59ae1b76c9e9ad1abf016f1ed92d978cd
SHA1eacd2a22428799c0c9f0c39c6fc8637d11149037
SHA256e2935c9aa7ba7ea9bfe7256ae0741320d2010b47d8c6e7b0c9065df65b936bc0
SHA5127f9850bfdea150c19dc66051fe28348e0abb7b022c45364b2cde24cd35b3c46e69373423eb3553a1ea121ac9d476e504a6ff39e5c109b460e220c96c947d80b2
-
Filesize
7KB
MD5b6cf6967439d2a267b0fc890d1d252e0
SHA1fa1e6b51723770da4599bbffc0b4ba4335eeb9f9
SHA2565946bd3e9a756fe402fb03ca89b965153b0e2569b7c78473db18f8e85ed548fb
SHA512dd4b7ffd922de5acbfee2d0b395e3ef3fe47ec18eba22168cba957d47e74082a7ae6dc9cb1d9a7bff750f7606a92ffbf1639ab9a9c77ee5ce5e03e69263a901d
-
Filesize
7KB
MD530087b5163e6a35e66d3e3799a8d8e7d
SHA1fee206f55edfe2c881cdc0c1c00c511be5571c7c
SHA256a6b0b2a93fede10a82ae655c7cabb01daada8b9598e20d26e8cb92885d093bd3
SHA5121bd08155ed0b46dfa5976e19d909eb255f48baabef61d933baec931c329e42547c932acec736e1a18bf624840bd43b710d9157733a61b872856f42339f97dbf0
-
Filesize
7KB
MD5d46a1365248b4dd8cb47c531f2ff40a3
SHA1a28d1bb9b100dc5f014e4ae91651e6fb0cff92f3
SHA256923a02dab09791eec8a8aaf02bf98ffcc3dd469c4db91baf9feb0d84e13404fa
SHA5122db0f03a0b5a9276757433c7567af1396476f2ff9980269e19e848c782bc6adb1dcca34b25223f0c9af4f8d58bc826081260604312f30306a6e997fa2812ffe8
-
Filesize
7KB
MD520ae959e8aadc90db5e4acd74a5db78f
SHA1acbd4b79d06a23b751c5604a649983d29f006820
SHA2564c697b6ccc6d71ac5b7e8ecca9bee72e498e3566a4d7d986c2a4821de2e8a82b
SHA5125396a179f3e5527ff5914b1bdfda6abf02553f5db5f0bdb30caeb525c9c6d4dcb8b91cd9bf490384a95561b1f1e87d277fac7750eb1b0d91c56d70bb221609de
-
Filesize
7KB
MD553c790c61aa3f0d277d22b619dd268eb
SHA1baec6c32a8bd0bb969744fe4e0e4bfbd7ce00341
SHA256849edf392f2cd2158e23161125e00321492cc753f66fc1a662f2a6f22e784a99
SHA51273e25cedf163adc2c7e9daf192aeaa20073380db2c140ea3de040a7b4fe9d3d434d80c302ef9fe392f4b51bfd0183efad8e092d7ab8cad4804bbf1b5d35833bf
-
Filesize
138KB
MD56ce13532873544753be6a8f619b7b19e
SHA1a36e5d024a9f701c518b27f3cca364659f661d1b
SHA2561a9c2c5827120ad67fef9e2a054045c6d10312581c5ce7811ab9c790d2f55315
SHA5125cfde7c212c24ac2cf1f814e400c40e7e6c933305404604c2035fa8c11d4f5993752799775976248dab6431d11341d31620d08dcbe01dbd6d46bb79a78833928
-
Filesize
97KB
MD5c8f63cccc0e93024c59a202258ead6ad
SHA178bc0415175d5ef14f88039d406fed9e2a3c61bf
SHA256acfeacbe4bca955653e3abddf93b033e402adb2b7fdda16db50d13472255a91f
SHA5124dcbb6186f303286c2ec2647f386d511920cba545b6dd6667c524340afd48c8f432c2a9dccf3c7a5f83bc2bb3ded239065910f0e4a6c0fb074a8016e36f03dbc
-
Filesize
88KB
MD5ec2c98c84f4a25f55bc99f5e5f9836c5
SHA1c0140965de47e667fd8ffb356ab2465a904ea8c9
SHA25630d891afb075f99bfcb6941b13c71df539bd130403049b53c182f9fef23aebf7
SHA512f675306387899704c661e08c08bdea9de66daacb7e6658ca708ee94b32da940f007f4e1d71347b382fc8aa99691ff310725cd7e522f59e9ea32681235ce61501
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\activity-stream.discovery_stream.json.tmp
Filesize27KB
MD5201bdda3567edc94ead5809a9dded25e
SHA1c244ed7ddd84ab33ae042b9b06863d33bd4595b0
SHA25661584865ec3515c1c33adad3d19aa102b4dc61dfc262b4e80f1cef95f3f718f0
SHA512393f2e70e9ea167b3903ae7d602d38ddc38b94f7062b98985beecf85021816a41dace88a8da5de5f886f7269104938ac81faa6e95efd72cd34470b6a8321a4df
-
Filesize
9KB
MD57471e9b4465d8a8cb8107bb71fb744a1
SHA1590ef2cc8a8dc8ae0de7b6bf0cbcf28c07e6f7de
SHA256befcf46e2cfcea4da4550ab36613e80cfe72e9cf32883085d400bf17962e4af6
SHA512800bb43c55665e7222827088e7e15de8da47b5b409ec1d730a1cb5bda70cf6866b42ae794c50712c5524b1dc6764a035cd03d51c0c963741a88e2b1059a4e8a5
-
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kvgg58fx.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A
Filesize13KB
MD54b24f3ee9c3d96a285166ee7d1937fc2
SHA1f9c9f559c0f95d54a30224eeba5bff7a33ec8d57
SHA2568710ec42f4f5ee61394e71437582957f944353537c4dde296c82779c89319515
SHA5128268c08b01bd485a2b25f754727e1273c37455ff477b48e88e9d4e5d78fc2fe3a379312ac0aa6d509d54b9e6b91c5b225fc92807a4d8b183ce5564aa8dea23ff
-
Filesize
7KB
MD5d02e216c527f97b5cd320770cbe03a0d
SHA176a0bea3650c393341e240231cf999d11a3d8eb8
SHA256cda679d62e2852d900f412239e7c01a64a928db6c0cc03b8fa0c1eabdfe815c4
SHA51239d99ea0045e332f197f0d6430a71adaeaccd1c8e1028ad997ffa5527e5a0fe5dbdda62e02329ae1824abad43eedd64dbfb05a1e8e19010745bfe8d53e83d990
-
Filesize
24KB
MD562a6f7756aabaeafe2eaa8a1b19eeb99
SHA124b7ec2cf0712f03911fad6b7ccf933e0879fe5b
SHA2564c4d8324fc74a61ed5477b6602fecd1f404f524e6c17c6d7a0b682f8521a29d7
SHA5127d30a35811f4dc5e3c4714224ac2b143d17f6a1de744db230b3a74409c6705233831e340b13d468c612b9e924cf69a62a15164e601e62609c98a46cf4ec0562f
-
Filesize
13KB
MD56cac9c4cbadc065beeebe16e57279a9a
SHA126bcac80ab11c56d8d9de74a85ef2314044f96ca
SHA256f33b3bfbb97fedfe2d77ebb894c7db5c32b8905bedab6c58248108021cf96bdb
SHA512854b505ca4d17127fafabc8e4d903e097b6e77d4adcb2873185333a7fac68d6e903b2e8f3ce0df639ec3c44feb3666489405ee74d49f512700ab86cec4bc9e44
-
Filesize
442KB
MD585430baed3398695717b0263807cf97c
SHA1fffbee923cea216f50fce5d54219a188a5100f41
SHA256a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
SHA51206511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
-
Filesize
8.0MB
MD5a01c5ecd6108350ae23d2cddf0e77c17
SHA1c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA256345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
SHA512b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
-
Filesize
75KB
MD5382d71342a14696a6738f3a2e741baea
SHA10f513a7a95f9cad244a0314c33217b12bd4ebd26
SHA2565df7bc7869dfee9ff4f08b483799e7b690e9e68433047b6b6ee6b72d6b02ed3e
SHA512c9849d2c8e19694cf842f3cf121c19275396283b63b9f7b5d40908903ec9d9e5ff93120ed0e8b2dae6d591689a0e5f31d704e3e89a544c92774842afba2da185
-
Filesize
1KB
MD51de8be804722efbcfdd609c3c07812ec
SHA112886bd93f3b16b28f18bca98bc24140f7c7c23c
SHA256639f685be33e7765e4dc25e64935abfe4870d9403d22ef0c2060882c81875df9
SHA512df2348eb0fea277aa11cfbd025a2a070d1177b742a900e26d1b768f5051d9e1a8d1c83efa129eeec71f8e008defb13554c16ae01c9a0579c1297466837f3435b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Filesize15KB
MD54df9f44885bb9362e9ff6e84de018510
SHA1211e6cb7f26d2243d6b6d6a8880a7edf126f2a11
SHA256e37421a163d7d655149bf9ee88717bff5cd24ec435215847bb87e5daba58de33
SHA512cd8cfc69da74dc915cc3a4f4d2a87ef0c6385f87313fcb412897a29b407b0ee44c8bf99a18aadbbdc9cd400c25d9ef535480dc2a9a2727f274a70cfa8016fb82
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Filesize997KB
MD5fe3355639648c417e8307c6d051e3e37
SHA1f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA2561ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
SHA5128f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Filesize116B
MD53d33cdc0b3d281e67dd52e14435dd04f
SHA14db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA256f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
SHA512a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Filesize479B
MD549ddb419d96dceb9069018535fb2e2fc
SHA162aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA2562af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
SHA51248386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Filesize372B
MD58be33af717bb1b67fbd61c3f4b807e9e
SHA17cf17656d174d951957ff36810e874a134dd49e0
SHA256e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
SHA5126125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Filesize11.8MB
MD533bf7b0439480effb9fb212efce87b13
SHA1cee50f2745edc6dc291887b6075ca64d716f495a
SHA2568ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
SHA512d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Filesize1KB
MD5688bed3676d2104e7f17ae1cd2c59404
SHA1952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA25633899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
SHA5127a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Filesize1KB
MD5937326fead5fd401f6cca9118bd9ade9
SHA14526a57d4ae14ed29b37632c72aef3c408189d91
SHA25668a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
SHA512b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
-
Filesize
8KB
MD570a4c52cd7d4a4f4b35055236de51d38
SHA183c2d2781956b5e5dceaa579280fe81db80bd364
SHA256ec1da14f8918561615b2506ca4a719be5eb58a7be07e7999a97240dafc9ebb1b
SHA5121bdbf6c8e1767217898daa2c6e9c1947c2db6990c09c678f13c343a8ba2f1dfa68f1f73953e8ac70139d83cded5fb1c7e03289b3d8202cf2ab336df4d6024291
-
Filesize
6KB
MD53b1edb57884de0f1995232f0f3b69aa7
SHA17526b1a0a3c06e3d5e57765cc98e68242c65edfc
SHA256d42d49aa76c48d2a04f276b0b248f642ee372df321b88963ad5fdd9642569ea9
SHA51213eec9493572e67b12a5fd1f8a16eaf2d3445deb1cb124a2e51c28daaae83b6352373e640ea41565b57a7216ff54a22072eab2f34ac1c35c17ac1a157d125b39
-
Filesize
7KB
MD59cb39c47dc7c5ff6fb92dee9e43c21fa
SHA1dc333c68507cc3aa6f047578717a865a2aced19c
SHA256442d1b50ec0a08aa8bfce8b974def8747d738de9cf70e91ce11dbf8c8fcc7ec5
SHA5128768a622d947f8b4c2986a19b499ce15bad9418033d9948f95f21d76bdeee17b708d65eed747a2f74798f75702125cd6da87367025f83b23564170fb67032a3e
-
Filesize
7KB
MD5bb06ab7ce8701d23329091b0178c4fa3
SHA186964b1de1b26eb343da7959fcc7a291457c4561
SHA256a80a8b43887a63f2c7d37300b0872c98276abcad69fb207b4ff1f26401b7b65e
SHA512ca8b4e2057433a8cc262212bc6f461cf4c8251a959f4c91d9d7ef0a291785208c42fda0759504768fa75aecf72a5a5a280a34b12e9422fa00804807332c45f87
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize1KB
MD5bc68a878350a22dfafb06099467b079b
SHA1f50616342fa4ec6f5ea2e8c768705cdedba2c0ba
SHA256efd5acc250ead0fe7981498f900e5505426e43bbe9339e3c7c6784f5b7e7b0b3
SHA5128bd73ac530f81a021a46e9c52243e06b4b6a2732929f3712e3a1b612d3fbb3ea33429d76068ac68202ea7d19ee82c163243d53188f39ec99f8016fc9df6d8858
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5d3b143bdb8db1b93c84fec324c32fe02
SHA1d54a090fe6e6c6bf086f989df34fe8bd982ee4cc
SHA2568cbc26fa185ae21dcdc25f70be7e6d431fe3ff53e8d689e6b771be3418572686
SHA512ca1e469080a089e6777a528698e00a24b29bf65c0ec1408ed4fd8ed0171a32ac971bc78c377d19814c3a771bfb89909e219189ce311d631b46f35570ad9dee8e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize5KB
MD567491eea9474596e9faca5adb10735a8
SHA153311b28ff5a89293a6497ab42d73b6051e0696d
SHA2564f792aa33ebd5542f45c5654d58c3fc9a876154812faf03591ba2d23bc5b0ae7
SHA5121f52ecfebda61a71289cbe5cf2de3c445eed6a8cc62bb7718c74c0a4927e063fb8202e64515993166b7ce464f75b70f54ad7b866fcc245445336b91d80d06f0f
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD5720417fb6ba540cd2131a60395ebdfdf
SHA1f3efe8edb82487165df6661cf89018e20ca5981b
SHA25660d921da37353ff4c04364aa21c344a1ed6a1ec168f7b89ca906331f0b113da2
SHA512e4b3fffad64e29cf537631f8d47c3a578d8fe8d9cc80bf345e3b41a6c90aa374f46c17b4171607c17a3aba581ed15bec54ddef2eefe1f66e1e9409c311e777ad
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize4KB
MD580830e33ba84bbdcc3136bfc8e67daf4
SHA198dacb21b127bc6ab11d69085045b899b8f950e7
SHA25655f5ef9e2586f7b64d5df68559910c5897ec8dcebd01a99b2ae643fe4e6988f2
SHA51243afe25a644bf51571f85b3cd97b8cac66ad1b3a77ddf7fd2468cd81a12ed3586b86689f69cfab01f01a885dae9c59feb31f4602a78d79cad3fb29ead668ece7
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\sessionstore-backups\recovery.jsonlz4
Filesize6KB
MD501f8bc776f728b5618c68e68fc1de855
SHA1f0c39067a3c3b14402efb1867669f4e62367874d
SHA256a28b84a58e1a1bc77ed05c7616f192e1b6bcf296265137f22ee6c1d72527814e
SHA51277935d4f5ecdc616cc35674e968d834d023c654247d6c5f3d4282eb9a4126e36d7872352486e4fac81b23b19b1d89baabeb29192652dea81af51f3d10819bc3d
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Filesize182B
MD57d3d11283370585b060d50a12715851a
SHA13a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3
SHA25686bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
SHA512a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e
-
Filesize
27KB
MD53f030aed9b8a67a8438fd0022e6e8200
SHA104a96d03d9fb2d318f0920c90fc24a17b168c268
SHA2564cbed17f3f6a27b063965777e979e4b81fce38acb19a7da1f30c6db49cc04c88
SHA5127339262548d555df98a940f7064a4ef35bc07c794fdc497a6e140b5d294be914ed33d20b72e8c8965e6fe1d8d6104564d472232a1fa6422687040b656b06b188
-
Filesize
5KB
MD5766f7bffce96af75208bde8600504b39
SHA1a09f6f9235469d9c140dc7681ad4338de826c5d7
SHA256b8654257bb111914b6d123036669931f44b2823f58967cdfa6eb8382db9de0a0
SHA512bde8732e88877c86a89d48a31406436ce063b5890604b8c6f79ffd4dc66d266593f502a8bd4a9e4642ff139fe357947dd4b3927516a95140c1ae41fa6f236665
-
Filesize
6KB
MD52ebbac0d217b8dcc88aa6e2803bde624
SHA1cf49655a98411bbe957b7d2ca684716d386b97e2
SHA2560371eb4c0a2702535cd6a4408682349eba53f49cc9cb27c98f4b3c8f19eb36a6
SHA512dadba217837d838cd1bbbfadbce57a40b60fa13c300a5a346cc9ec1545f0f4102dd91373c7abc04b6f20a62014630a7080c6919afea21f25dfb0ac710921d598
-
Filesize
1KB
MD569fd2b10bad13c35b6873ca3f840d7f2
SHA1a5fb0f53bd0519163dc9568eafe88aa0fb273db7
SHA25671360ffc2361e4f319bd5c786b5ddd40f9dfd84aa110996561374ba005e10c2c
SHA51224f497e5be45d751ecae855a3944dca0a868f6cfab7d2bc803e1e2d7968db16fb0b83bc54dbeb28a559a5dc0d6b90e91f0787d1585224223dfd135960177fd29
-
Filesize
5KB
MD5869d4be15e4c655a6bed4b5c582433a5
SHA126af98b82eeee4b90bc87c150ec30f829402b1ac
SHA256e28387b09835a15ef8a1dae1ddbe48f6aedebce372650448c29323fdb238ab6d
SHA5121460a40e666ee315c7175cbd2a7d4415b220ccfece19e680293c922b4e760fb8e9b4a5edf183c4370b776cd906a514100f26a23c13b90aef35dae03eb6c5c9f6
-
Filesize
5KB
MD5e049e6ff5e70e69260efc33fdcb7fa74
SHA1a8ed6444dd3de2fdc93d8daec2b5393369c330e6
SHA25682acd0cb1ebc8931ff16afb267aba13419ef9f6fb87504dfc72f7a38e74b218d
SHA5129d3a45c0ef3192de6c77281c187211aac82422af724156372bd65cb742eeb41ff6aaf784efe8f83bfe0bb9c780736ff814f9d7b8ec1a8358e0a8d210e8bdc813
-
Filesize
5KB
MD50b320a68c2cc97c65b29f24a92c18f17
SHA1b399dff650a9e7d12ccb635075103cc4b96c8d70
SHA256f27e28067b5f6df1656cf843f84c259cf54b1e8b5ff1f308e4d365292ffdbbca
SHA5127ff5d0b2b4382634e8ac7f96dcc428f26360cafa425889785e62b27a562828361d8c6cbc84c41d26e331eb8f84f750c67117abf8bc4870d5045fdd2f497e0927
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
Filesize53B
MD5ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA256792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
SHA512076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
Filesize90B
MD5c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA15942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA25600ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
SHA51271ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
-
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize160KB
MD5f69342eedba5160f25a93c9a0518f2a9
SHA196917291eb40e38646f49d04fd9c7a00c9f4c1c4
SHA256ce1f341be920147166a36ebfe52e4ebfb9dc313e65b04329a518878ab03ef973
SHA51267b2ca0fd444f437ffdd2fab15f9796ac8a8e84fa030922dc5604dccbf27189967f38326737ad5e259a6d5ae7a896e8754275911a50b0710ee5daa9846f3938a
-
Filesize
103B
MD55b0cb2afa381416690d2b48a5534fe41
SHA15c7d290a828ca789ea3cf496e563324133d95e06
SHA25611dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
SHA5120e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
-
Filesize
2.4MB
MD57c886c2fb90c9d308c3a285422b44866
SHA1660eeea4084ee7fa577e2bdbce3ed146a8a1ec06
SHA2562f04a7a07cef84837dafba581d0e75631ef9e000a18929145b779364aca71130
SHA51291e2d575533dbf02a20e18561922c7f7057c77b7b80bc5b140489bd95e887b27bd6731d88a1f76e679c259aefdc9a5e03b21cb46e6c40ea48aad82d043121f49
-
Filesize
7.8MB
MD542c1ec39ebc4c190fa1a518a92296c0f
SHA1d84a748966a4f26d13fcb3af97a4f63449929423
SHA25665166acc79900cc7705d77fac20dbafaa920fe40109127159fc63f0bf05474eb
SHA512639138c5a39c7afa6a3013c3e5cbe1d3b8ee6cef79062ccd4ff0069303d221962d4da72d3a8db0f80a44b65df84f2ba33f52654dd9acc0e269ea63e0c0fc9b3c
-
Filesize
24.6MB
MD59432eefc3fecd358f8b7c0859bc6bd5f
SHA1400ed9122bb41c298f9b0d7fb700cf16fe118779
SHA256d7000a7ac9522baf1bb41047efd06f6f80e5780550ae40bab32909a78e5a5d3c
SHA512d194820d9b282fc0126b5381230dc1764cbce1762e73b5e845c37d80c6a43db032b4254fb1f709caf05d07b3d34d9232fbda28b61061b3ec2f6a200772eefbdc
-
Filesize
429B
MD53d84d108d421f30fb3c5ef2536d2a3eb
SHA10f3b02737462227a9b9e471f075357c9112f0a68
SHA2567d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
SHA51276cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
-
Filesize
42B
MD570b1d09d91bc834e84a48a259f7c1ee9
SHA1592ddaec59f760c0afe677ad3001f4b1a85bb3c0
SHA2562b157d7ff7505d10cb5c3a7de9ba14a6832d1f5bfdbfe4fff981b5db394db6ce
SHA512b37be03d875aa75df5a525f068ed6cf43970d38088d7d28ae100a51e2baa55c2ad5180be0beda2300406db0bdea231dde1d3394ee1c466c0230253edfe6aa6e4
-
C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Filesize930KB
MD5a3fb2788945937b22e92eeeb30fb4f15
SHA18cade36d4d5067cd9a094ab2e4b3c786e3c160aa
SHA25605b98840b05ef2acbac333543e4b7c3d40fee2ce5fb4e29260b05e2ff6fe24cd
SHA5124897aefe3a0efffaa3d92842b42fe223f0b9882031a65bea683f4554d1fec92b8a66ea15c67e9b95c7fc12991cde3245010ccfb91768ba233711ced3412c13bc
-
Filesize
1.8MB
MD58379d4a51d2a9b8973a45592fa8b638a
SHA10b056ee546c3d4f65ccb54aad14f293b3e6252b2
SHA2568c12ee73b212edf7bf85525c46cc15d5267b2728de52fd3e5cc59fc86aef173f
SHA512c4571fd0d6b5b1b41c5b9b43c70e09fd6a287e4227eeabdd0c10157a852f7d4691281ea1981c45d3a9d6335e4335fd1eeaf934ebc3086c20e76355654f35db52
-
Filesize
297B
MD5793eae5fb25086c0e169081b6034a053
SHA13c7cc102c8fcaf3dcbe48c3f8b17ec0f45dcc475
SHA25614e396a360e5f9c5833dc71131d0b909f7b24c902b74f31a7a3d78d5aa0fa980
SHA5125e949be232df14bf7bfb679986a16f4a613439f5b5e71271abbfbf74296b43c977510fd6403702139ffd77dd3369e054dbe086e0188fff4f436f3505654e1f70
-
Filesize
225KB
MD527dfbbe8ee4015763e3c51d73474e94a
SHA14328cdc9a3f9c6b7df0624c81afbd3459f213e40
SHA256b4fe7b745c5b40e5d6294a883afcb8b4264b88d331fd0b4620050441479f391e
SHA51242cc921fee7bad58ee1fac12eb8153b580b5d9d6ed510d5df4bd4be754ef1b017c987051385d828b70de050340f9629be7b385d0338c9db6e0f9f51543387375
-
Filesize
589KB
MD5e782457ebb0389715abdf5a9e20b3234
SHA1e0d9ad78d1972d056d015452ed8dee529e8bb24b
SHA2560e90d375cdb64f088a6a676eb560b755afa184e523fefbb9c33fdda4d7dd8461
SHA5123ec030fdaa18f90bd8060466276c9ec49fd9233746e603d61a4f65a9a53e97e7b3382f8f913da17c48ffefc8adcf2be25f7e1c51f16555068b8f344a4e6dd961
-
Filesize
91KB
MD5ac01114123630edca1bd86dc859c65e7
SHA1f7e68b5f5e52814121077d40a845a90214b29d41
SHA2561b7b86711479fbfd060ed38abe1258246b4be2826760e6827287958218bb3f5c
SHA5121c9ac878ba12f3de207aa9a7eb8c0239f769f9ae7475fec998e998192aa6900fe146039ac982612c6c0b7e5363355f2803d8f62e4787c0908c883ac3796e2a9b
-
Filesize
128KB
MD512764d72c2cee67144991a62e8e0d1c5
SHA1f61be58fea99ad23ef720fbc189673a6e3fd6a64
SHA256194e110cb1e3f1938def209e152a8007fe5a8b0db5b7ce46a2de6e346667e43d
SHA512fb670a7dbb57465d6384cd5c3a35356e94bf54ac4cb7578e67c8729ff982943b99c95b57f6059443e3e8b56d8c8d2cfc6e81ae3a1cf07306f91c3a96e4883906
-
Filesize
224KB
MD5f0b22427c3ddce97435c84ce50239878
SHA1a4a61de819c79dc743df4c5b152382f7e2e7168d
SHA2560282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084
SHA512ff2b22e58597d0ba19562c36f03cf83b5f327eee27f979c9ff84fe35a21b1fc9234f21fdb35fb95f933c79b9cf7760328d29b31480153da59a6576cf5f7f544e
-
Filesize
7KB
MD5778376d22591a4a98bf83ac555ddf413
SHA1608172ca18450b4cc61ff6cc155f66cff55c5bf9
SHA2568218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
SHA512e895a03374a3d3da04554cd048191722652ed4f1f7cc91639354843138ce26aea6c7f2da0ecda47eb76bcdd61a0315cc2e35e080a5953c24d82f4e94ce4aa260
-
Filesize
21KB
MD59390ee64243e5335b79e33e5e8311341
SHA1c8d4b3ab79f6b12311eb4e4da29e709e583b5870
SHA256cff9f0e51e7f1d95934cac31d9ad43ba453ee308c7b46a27803dc7e2e6c3adef
SHA512ad7b23dab247c5c71298c5023bc58bd1d00160145558d86ab75dd37de1f1017540bac544cd9bf1cb2802d19d2973c0cf189d05a980777de886ffb552ae923bc0
-
Filesize
198KB
MD57b5138efef2c02dda9cfae9917cd913f
SHA1b44b58f354c4a68e119df226f01ad763b2d1025c
SHA2569f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba
SHA51247e4cfd2218c91080fc4ccc3ac13dabe9efb7c96b981d53577177fb062973b9fad0052edcf2b0c663ff3b7a1d9e38e96586c93cb72618d64344b96e3df13204c
-
Filesize
7KB
MD5bd4c30081a164037311e8712423c5bf2
SHA12a13bc7987ca34644b075c1fe197ba293b4ca527
SHA256bc19f17d7f6e8f280c2cc95ef6d1b67fac25becfe98722f482039a4d84f3c9ba
SHA5122a20d113b73cbca311d08dba40dcb7f8ab9d5383f7590b61b785070f77204db9ab163557a420c6c96ede815643f82ffdf75bc59b5802284779ff237616734c66
-
Filesize
5KB
MD534699ac8824cdb6593b4dbef605dd6b2
SHA122ff82e35cbb1ac9053f767f404ee351786fe0c2
SHA256328d80e11e7f65f9b6e4bac12de32b7ce42154301c2a14ba92155e32e05939d6
SHA512fe714d5d44c6c2f4f96b4349bff301a67749bcb084ade3a0270723f1fa6bd6061193c4d782cb663d63e2c32cc809f33a8114e2e0bc6915de2b04efc82b5de673
-
Filesize
111KB
MD5fc6ec655d6a00c567119522854e24172
SHA1b72baef2dc0aca98cf7d3458cc027f4b0622db08
SHA2560d188756c9c282bf31738af5373f2363cc8007bbbc8d5560fae5821ed4937611
SHA5120a0eb23751b5df39becbbb308b6b36e324ea6ec469d2167a795cc10fb3bc38cb7b3187a3a63566e280470b09a080c000280e3b9a01681a68f8a3f35c7a2f139a
-
Filesize
690KB
MD585e98ba2b208808db0f352cc75c6c6be
SHA13f7f543bb097c3ca9febf62a74bff06930a95fe3
SHA256549ac6131d5a0d6ba8d653c27fd953672bb1c4780ebf2953aa1b7fd25bf2b62f
SHA512f2069dec3d85eb83430d93a46e32a9d528fc9574a7da6c39825f92da7fdba88531fd0639ba389e73dfcc52257fd79675397ab2f53861e1a8fa05ac139b8a9e24
-
Filesize
43KB
MD5511067dccd926c528e9f6518fc16c4cb
SHA184d6c8a784d7b9c3012312fe9ee8dc769a01ffd5
SHA25607e7f225894d055aed95bb39b0ed761a5bcd479dc0cecab218477a91ae81b9bb
SHA51249581a970cc5c694bc949281cfebe23d53497a67f073537f6107a2b58b29f11eb0d6483b2c38dbb2b15f857b63695a639459252c5c35919f8ff10d9300379dff
-
Filesize
1.4MB
MD5ee5bd0cde8db4ce8af55699c7c99003c
SHA1fc00280601a1f895031e29e787d64f13718b431d
SHA256a6f3d485f373e4c598545e702c99ff0921c7a2180ce54d73c972c1eff599fa72
SHA512fce9c194db68dcf9842e602deb85901735509bbf72af3a4a69192e61bf2533c16d34bde2cb25c3521fe98ccc7044a6b35a330f4e6d019fb28130ed627529d1cc
-
Filesize
2.5MB
MD5df60ab882983b02912a0cc8506143959
SHA13219888ee11ad95e84f06f113294f75f39824a35
SHA256e02ffbd776bcabc34f50d7af846dd7564e1f85fdc0139f155f7488887ed75645
SHA5129b31e053f5761592baffac36936a734078ab38894582c7d3734bdc537a27fa057633bd1ef3681c026d73b62e73db0b47d819ed4243377c1141654807e4098e2c
-
Filesize
472KB
MD55bc752e9fe99fee6eed9dccf378daf98
SHA1a5e478b4884e1322dcf6b9fd2c6763bd4f32c357
SHA256ac5bfdadf44e54bdb11223826dcc74146882006b657b6b5d7bdb57dd959a0e09
SHA512e3200a9a427e440652ec3df6a27124e3d3be79b82fb6d2e5444c859884183ef728e7b0f59ba280d6cc755c409e974e0d84f3d346bc273986cfd8508e4420343d
-
Filesize
18.4MB
MD5e8cf227c3e9a23a00922a743a817a7d5
SHA17c999ded895aaf4a7cec52f6e638d325e640918e
SHA2561ae60d7145a28789349fce470f7d389b932284602d105835fa21f94f06a46b2f
SHA512b15fcb5b265665b73717f0ee40f1e485f29f4d632cf363a2d0fcfbc0dc7c4f7c5cf3aec6675e8c7f12deed1fce121b3d00e3442eb92ebfbc7b1283c53eb51fc6
-
Filesize
288KB
MD5836a249121bdbbdf7b02cf757862033b
SHA125279ddc3e82391d2c448d7b45c29cace8b4b93f
SHA25699faddef662f3a6e166a10421a169153d25431d25f9f3feb01e0a30006f25665
SHA5123d4b5eeedc3e83f03cd1f693019526b704ab108155dd2dcc09cd1aff3cbf2c5025dd64fbcfe60fa6d0a3c37b709f23d8a4e89b2a5df5cfaded3ba6769083617d
-
Filesize
829B
MD5eb02fa3056421c134ee6d7bf4d554a69
SHA10514340ceac4f47edc67e53c683bf25fff327ff2
SHA256888b0c5522ee97e7b5014623044b43e894b3f8b54f86c625bba401770251ada1
SHA512f874e131683eb65ad17c80e13dad6f8fc34061cd3c1e177b75298b05aef73c9c616247dbe9e1d64af4076badf5ce5aef573ff1087f7b0e85c214fc1762b94c41
-
Filesize
215KB
MD55c571c69dd75c30f95fe280ca6c624e9
SHA1b0610fc5d35478c4b95c450b66d2305155776b56
SHA256416774bf62d9612d11d561d7e13203a3cbc352382a8e382ade3332e3077e096c
SHA5128e7b9a4a514506d9b8e0f50cc521f82b5816d4d9c27da65e4245e925ec74ac8f93f8fe006acbab5fcfd4970573b11d7ea049cc79fb14ad12a3ab6383a1c200b2
-
Filesize
62KB
MD50a3487070911228115f3a13e9da2cb89
SHA1c2d57c288bc9951dee4cc289d15e18158ef3f725
SHA256f73027dd665772cc94dbe22b15938260be61cbaad753efdccb61c4fa464645e0
SHA512996f839d347d8983e01e6e94d2feb48f2308ab7410c6743a72b7ecff15b34a30cd12a5764c0470c77138cf8724d5641d03dd81793e28d47fe597f315e116fa77
-
Filesize
2.3MB
MD55641d280a62b66943bf2d05a72a972c7
SHA1c857f1162c316a25eeff6116e249a97b59538585
SHA256ab14c3f5741c06ad40632447b2fc10662d151afb32066a507aab4ec866ffd488
SHA5120633bc32fa6d31b4c6f04171002ad5da6bb83571b9766e5c8d81002037b4bc96e86eb059d35cf5ce17a1a75767461ba5ac0a89267c3d0e5ce165719ca2af1752