hxxp://torproject[.]org

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://torproject.org
Sample240726-k4pbeaycmp

Score

8^/10

discovery evasion trojan

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	tor-browser-windows-x86_64-portable-13.5.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	firefox.exe

Executes dropped EXE 12 IoCs

pid	Process
4508	tor-browser-windows-x86_64-portable-13.5.1.exe
4572	firefox.exe
3276	firefox.exe
3520	firefox.exe
5248	firefox.exe
5468	firefox.exe
5352	tor.exe
5640	firefox.exe
3704	firefox.exe
6132	firefox.exe
6036	firefox.exe
5996	firefox.exe

Loads dropped DLL 59 IoCs

pid	Process
4508	tor-browser-windows-x86_64-portable-13.5.1.exe
4508	tor-browser-windows-x86_64-portable-13.5.1.exe
4508	tor-browser-windows-x86_64-portable-13.5.1.exe
4572	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3276	firefox.exe
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe
3520	firefox.exe
5248	firefox.exe
5248	firefox.exe
5248	firefox.exe
5248	firefox.exe
5468	firefox.exe
5468	firefox.exe
5468	firefox.exe
5468	firefox.exe
5640	firefox.exe
5640	firefox.exe
5640	firefox.exe
5640	firefox.exe
5248	firefox.exe
5248	firefox.exe
5468	firefox.exe
5468	firefox.exe
3704	firefox.exe
3704	firefox.exe
3704	firefox.exe
3704	firefox.exe
3704	firefox.exe
3704	firefox.exe
6132	firefox.exe
6132	firefox.exe
6132	firefox.exe
6132	firefox.exe
6036	firefox.exe
6036	firefox.exe
6036	firefox.exe
6036	firefox.exe
5996	firefox.exe
5996	firefox.exe
5996	firefox.exe
5996	firefox.exe
6132	firefox.exe
6132	firefox.exe
6036	firefox.exe
6036	firefox.exe
5996	firefox.exe
5996	firefox.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tor-browser-windows-x86_64-portable-13.5.1.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 765299.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
2308	msedge.exe
2308	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe
3264	msedge.exe
3264	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	firefox.exe
Token: SeDebugPrivilege	3276	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe
2308	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3276	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2384	2308	msedge.exe	84
PID 2308 wrote to memory of 2384	2308	msedge.exe	84
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3568	2308	msedge.exe	85
PID 2308 wrote to memory of 3580	2308	msedge.exe	86
PID 2308 wrote to memory of 3580	2308	msedge.exe	86
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87
PID 2308 wrote to memory of 4248	2308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://torproject.org
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa672746f8,0x7ffa67274708,0x7ffa67274718
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.1.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-13.5.1.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:4508
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4572
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3276
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.0.1389898026\2023037780" -parentBuildID 20240708120000 -prefsHandle 2652 -prefMapHandle 2644 -prefsLen 19247 -prefMapSize 240456 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {1d3afe6e-9b64-476d-9052-9057816b09df} 3276 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3520
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.1.924114405\958032533" -childID 1 -isForBrowser -prefsHandle 2208 -prefMapHandle 1956 -prefsLen 20123 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b5e29128-7091-4cec-ba9e-a6daac7c3702} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5248
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:d51503939bf02048603e17b254d1ddb154cfc2de00aa5dbd8c572a1266 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 3276 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:5352
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.2.968219585\1378154503" -childID 2 -isForBrowser -prefsHandle 3096 -prefMapHandle 3112 -prefsLen 20897 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {0750ab0b-0241-4546-a975-519b114654f6} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.3.1902159688\2003951641" -childID 3 -isForBrowser -prefsHandle 3588 -prefMapHandle 3592 -prefsLen 20974 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {f8216d1e-b675-49f0-99d9-5bee2c46c66c} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5640
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.4.2095820575\1504586311" -parentBuildID 20240708120000 -prefsHandle 3428 -prefMapHandle 3288 -prefsLen 22278 -prefMapSize 240456 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {ae729402-9a90-4150-aabc-adcf8d1b5c26} 3276 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3704
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.5.102342268\101266677" -childID 4 -isForBrowser -prefsHandle 4144 -prefMapHandle 4140 -prefsLen 22313 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {3ac16fec-4ec3-4f87-b53d-8f4859e78d2d} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6132
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.6.2090577825\1978898827" -childID 5 -isForBrowser -prefsHandle 4336 -prefMapHandle 4340 -prefsLen 22313 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {1c2d7025-bfa4-4379-acec-f40a2055814b} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5996
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel="3276.7.178181959\838864724" -childID 6 -isForBrowser -prefsHandle 4516 -prefMapHandle 4512 -prefsLen 22313 -prefMapSize 240456 -jsInitHandle 1140 -jsInitLen 240916 -parentBuildID 20240708120000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {4a71a7e6-47bc-4b62-8c6d-ddcfe6f5ff52} 3276 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,13683075023393227741,2115701400573027836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
MD5 2f842025e22e522658c640cfc7edc529
SHA1 4c2b24b02709acdd159f1b9bbeb396e52af27033
SHA512 6e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
MD5 54aadd2d8ec66e446f1edb466b99ba8d
SHA1 a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA512 7e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
MD5 SHA1 SHA512

Submit Download

18c9fd0e-c8a8-4df4-88d6-e1401167ea1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18c9fd0e-c8a8-4df4-88d6-e1401167ea1c.tmp
Size 5KB
SHA256 9b093b898e724491c5a9366a113e373cb94b52c1ffbeeaa8d31f30e1fd330e11
MD5 1cebb734b8329b149e15ec5fd9d471e2
SHA1 984a0a336bfc127fc9f8e2221d655d66e171fb6a
SHA512 84e4a918620ab45bb505978034ae8a8120a4555d491caec12c9854c156d441f48ae0d907c37fe37df96d05524333883fab4782eaddb3d406a72c2cff91af11b8
SSDEEP 96:ndk4GnS1uiZkQqRwpvWMoiVmdeHcik7UWQyV+VDCziEwb:ndkzSIiGQqRGWMXE7ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 c37d528af8d0bb268d312ce4cc97051ef31bf80d1f8b077782b61b7f34164c56
MD5 8888d514f18ff126fe55687313235ec9
SHA1 81740f3879446072e7892c257b50b8677d05ade8
SHA512 3dbeec76722e2cb5b755e330f24833db96e1d207842c3b1141698c52bb57ccc54578afdc7026b7c96c0a32e1b4ba8cf0948201f0dfab65b7b02067c65d2df3bc
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 de60e80acca292099f36a2094fcf3f6545ae9191e400ef7e30e65b430052cfd1
MD5 e20cd42ef308df02d5b4ad9f135c19c8
SHA1 d8351d7f20d88c415a822283b8e9c5195a83f1bb
SHA512 13244541eeb4ce56352bb7d37d42355836eb94f55e684ee52d7ac2f8de5d4bc83fb6eed26cc465cf464a0c67393877a4dc8c4f095f40122dfd9184f8b586014d
SSDEEP 96:ndk8sQ6GnS1W8ZkQqRwpvWMoiVmdefu21jcDk7UWQyV+VD7AiEwb:ndkYSM8GQqRGWMPu2hh7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fdf2068c7de220cdd57d87f3253b1be56fca25985faaed93628b1e92b90a2556
MD5 41a8e77bd3c98e5bc70b2c312f8d05e7
SHA1 51ab2765e9db8a8e9f9d7d4407db6d9c47e42581
SHA512 95735f83dc29ccc4357f8b4cfa96f38de3bc04690c031ad8c7e6672780fb00fc86b6ebc12f6597a44bd72051b8184f4c86804a4ff4ab1c16faaeb8cd67a3d8d7
SSDEEP 96:ndksGnS1uSZkQqRwpvWMoiVmdefu21jcDk7UWQyV+VD7AiEwb:ndkXSISGQqRGWMPu2hh7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 3c8cad8f7224bfd8b5c2057645b1f0a7b0afec28a5d6fe1c6812fb145405d8ae
MD5 c6cde4f9262e171a8638f3bd96f46fd4
SHA1 770b81273e63399014a51b1185ebfc4ad7d7c97a
SHA512 e74206446973c1547fb793e3bb639efb4e46e6d4f6aa1e3f740cce4b32760666184e322f6a2c979d08b17969cc170158feac1c47725043ad24d5fdbc8df3328f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c43a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c43a.TMP
Size 204B
SHA256 116092140a72d6181699e233efcb9789fc8f804d0e610c23c8416fc315984376
MD5 c8a7538aca5fbf27052ef4701fc68d08
SHA1 b137dd9bfe802c477eaeeed82d2fd4307b08955f
SHA512 21e8e8b0d18e692a87402683c542da3593914d6a1daf088cfd70530c1643932b1e2295ed5ff1123884c37ed37147f1525fe29db98acbaeb9eb94633ba2f4af55
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 28fe5be4cb1de1edde55fe761af25186d83535ae83fc3a575f53e5afff189872
MD5 8bde40fb722ded0d5eb1d311f0b20797
SHA1 8fbaa2bc1c97da9101702119f148e8994131f8c7
SHA512 c9027a961ab01da07ab0e7962c0d47fc0f8de73c067a6aa671dfae0270e82fa249a57e61560a4019a886bbda1d7c58d38d521cc3d348a881dc7e1b75d77964ed
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupR4e2RUG70nCpFXWx3G1wx:A9iIxuERzA83h09RZxYR24WQ3G1wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b7e3a48728a071d8de1f4a3ac9cfb3bb0dc3a4c228f05e241c3ec9bddb55f06e
MD5 4da2c814c56f679ed9d6be4fa0737c9f
SHA1 c57ce9458290d0a7cf530ed2ba73148062ad263e
SHA512 0bec9f6689b962b99e97718cea1e6fc1c613c2bb492d7135aa0d36be57774833518d836cc727658ab8e0fa1276abe42209a53bb8f4de89fb059bf23d01f2279d
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupRee2RUQSO0MCpFXWx3G1wx:M9iIxuERzA83h09RZxYRAvcHQ3G1wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh1857.tmp\LangDLL.dll
Size 7KB
SHA256 cda679d62e2852d900f412239e7c01a64a928db6c0cc03b8fa0c1eabdfe815c4
MD5 d02e216c527f97b5cd320770cbe03a0d
SHA1 76a0bea3650c393341e240231cf999d11a3d8eb8
SHA512 39d99ea0045e332f197f0d6430a71adaeaccd1c8e1028ad997ffa5527e5a0fe5dbdda62e02329ae1824abad43eedd64dbfb05a1e8e19010745bfe8d53e83d990
SSDEEP 96:BF8xgI+WdT3agujSllnYa+smauMOPNZFXmTEAHte+IxoAhrEoUK3EMbL:nI3duglYOxKPNAhYj4oZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh1857.tmp\System.dll
Size 24KB
SHA256 4c4d8324fc74a61ed5477b6602fecd1f404f524e6c17c6d7a0b682f8521a29d7
MD5 62a6f7756aabaeafe2eaa8a1b19eeb99
SHA1 24b7ec2cf0712f03911fad6b7ccf933e0879fe5b
SHA512 7d30a35811f4dc5e3c4714224ac2b143d17f6a1de744db230b3a74409c6705233831e340b13d468c612b9e924cf69a62a15164e601e62609c98a46cf4ec0562f
SSDEEP 384:EqxMENunNCl77xuqKwbK5k18Qhaw6SPGcOAB2q/MBJyyI9wQ:ZxMENunNIBuq7bSk18Qc9SD/kjQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh1857.tmp\nsDialogs.dll
Size 13KB
SHA256 f33b3bfbb97fedfe2d77ebb894c7db5c32b8905bedab6c58248108021cf96bdb
MD5 6cac9c4cbadc065beeebe16e57279a9a
SHA1 26bcac80ab11c56d8d9de74a85ef2314044f96ca
SHA512 854b505ca4d17127fafabc8e4d903e097b6e77d4adcb2873185333a7fac68d6e903b2e8f3ce0df639ec3c44feb3666489405ee74d49f512700ab86cec4bc9e44
SSDEEP 192:kqJnVKbV2VxxxeKSGjNYe3LLGloVCg8++9KdJ:k80bV2Vrxrge3LLGlP++9KdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a
MD5 63b1bb87284efe954e1c3ae390e7ee44
SHA1 75b297779e1e2a8009276dd8df4507eb57e4e179
SHA512 f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 27KB
SHA256 aa4f645c88aca89a8bbdcbba1d8093f5f6020912fafd137225dba1cddab18719
MD5 cddb6b87f9b782ed99ba8fad645f65cd
SHA1 5e13ab6163b55148a7548a1bdb888dce30ec9758
SHA512 b142c951b31012abb738b488308ff45ced3e527f4588e7149a22181bb2979b49e89b7ed04d6e6919c6b6835014d834b793f8eb710d48d9ccc31bd91c7410ae9a
SSDEEP 768:v38WXIna4pi4h4z54uo4n4M4H4P4s4l4i47J4U:v3XJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 cf97278cb719120b85c02b83743cacdb6859a6c3d1bd1d2965fedf6396d81160
MD5 968c966b7fa4fe3e96b48eacec40f0af
SHA1 433848e9d54daff9f17c1baf99221df9c1e5e720
SHA512 dbb3d834095b3c980e7d34f9c5a1dd47147639f11700d55a9ac4deba687eb9208430732115727fbc8b6a2163a23718e8a3363ac3bd573f62b5fb56bb1d73486e
SSDEEP 96:xHlTeqGqTtbzvzMzoze/WPEnj82X1j2yHF7KVMhqBw8XsK:RRTtanj+yHoVyqBw8XP
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 d2670997127f8e378c70ec01fcc9ed903cc028bb95f60ea07dcb17fa177a9584
MD5 8cdd316972803db290fa8e7cd97134f0
SHA1 abff223d5f9748a13dc1a04359f4e6f623931aa6
SHA512 cf8f09227d74f511ea5805c7cf1d0e32397da1d63cca5882357d858d6be0960f5f84eadd965b3a995d6961c035ae6b8efffe5c3bd30b90bf3097ab41b4ec8a24
SSDEEP 96:xHWTeqGqTtbzvzMzoze/WPEnj82X1j2yHF7KVMhCBw8Xr:oRTtanj+yHoVyCBw8Xr
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 732B
SHA256 4f6e8d18974faea14322d6717476eb6cad4ef9c3f4bd7d66b0cf96d9056f09b0
MD5 96fee50f9f9c744fd49fb2e1924dfc56
SHA1 fe9e5395f6cf4af6c8305b3f46ed93d89aa63890
SHA512 c8e496fed463e2b8a14c6f9ee21c3f9cafe895c1383be389ace68395df5c7a174b6d192ed53732a94a1ecfc4b8dcfcd9019c7fd901960cc915aeeb62d80547b3
MD5 SHA1 SHA512

Submit Download

profiles.ini

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
Size 103B
SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
MD5 5b0cb2afa381416690d2b48a5534fe41
SHA1 5c7d290a828ca789ea3cf496e563324133d95e06
SHA512 0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
MD5 SHA1 SHA512

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
Size 24.8MB
SHA256 f13063c411765c6ee1190fb2870c1bb794cfc367aef9a53b7ca44019347c2eef
MD5 66dddf1dae49706c992cfceec3f3ba23
SHA1 074cea24e40f3b6ce7bbc68ff542b462be1c7fe0
SHA512 1e4f60e286e87a9720e1c41fa584e69036c20e77fa139f4e2af2bc2e2037441b7522e2fac3224116de011fcd2d2419a35f1e3c296f20157fdf91827e5c4d5630
SSDEEP 786432:i2DI0u+EBN3Gl9N0O/Xc5LaVcXupsB/CTu8KCDTj:K+TN0O/M5LscXu2/CTLKm
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel-prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
MD5 SHA1 SHA512

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 42B
SHA256 2b157d7ff7505d10cb5c3a7de9ba14a6832d1f5bfdbfe4fff981b5db394db6ce
MD5 70b1d09d91bc834e84a48a259f7c1ee9
SHA1 592ddaec59f760c0afe677ad3001f4b1a85bb3c0
SHA512 b37be03d875aa75df5a525f068ed6cf43970d38088d7d28ae100a51e2baa55c2ad5180be0beda2300406db0bdea231dde1d3394ee1c466c0230253edfe6aa6e4
MD5 SHA1 SHA512

Submit Download

{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Size 930KB
SHA256 05b98840b05ef2acbac333543e4b7c3d40fee2ce5fb4e29260b05e2ff6fe24cd
MD5 a3fb2788945937b22e92eeeb30fb4f15
SHA1 8cade36d4d5067cd9a094ab2e4b3c786e3c160aa
SHA512 4897aefe3a0efffaa3d92842b42fe223f0b9882031a65bea683f4554d1fec92b8a66ea15c67e9b95c7fc12991cde3245010ccfb91768ba233711ced3412c13bc
SSDEEP 24576:Jwx6eRo6nMI2l285rjpTflN87oYRPW9Swv762XQt9RYomqeZ:spR7MIWV5jps7oYRO9SM7pXQt9RTeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.8MB
SHA256 a2ebed521db5d43af62eff32b7ee77a7a342ae6661a0fda60be785329b3956ba
MD5 67f708f227c0338550952313e5e382f7
SHA1 43511dfa2d91f6cc4c429336678cbcf08ddb6489
SHA512 4a0fdece1ed1a290731ef21e976f3074b70660c957cdc2067d506e4f08f3af7673f578afb108263e7a61ac6e773c0f747ff325b7fa4a3eaa1f77872743813614
SSDEEP 24576:2l1KPos0QGVKSgcSuSwiW8hwrFYRKTCRT:2XKPohKSLSuSwSrwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

000_README.txt

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
Size 297B
SHA256 14e396a360e5f9c5833dc71131d0b909f7b24c902b74f31a7a3d78d5aa0fa980
MD5 793eae5fb25086c0e169081b6034a053
SHA1 3c7cc102c8fcaf3dcbe48c3f8b17ec0f45dcc475
SHA512 5e949be232df14bf7bfb679986a16f4a613439f5b5e71271abbfbf74296b43c977510fd6403702139ffd77dd3369e054dbe086e0188fff4f436f3505654e1f70
MD5 SHA1 SHA512

Submit Download

NotoNaskhArabic-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf
Size 225KB
SHA256 b4fe7b745c5b40e5d6294a883afcb8b4264b88d331fd0b4620050441479f391e
MD5 27dfbbe8ee4015763e3c51d73474e94a
SHA1 4328cdc9a3f9c6b7df0624c81afbd3459f213e40
SHA512 42cc921fee7bad58ee1fac12eb8153b580b5d9d6ed510d5df4bd4be754ef1b017c987051385d828b70de050340f9629be7b385d0338c9db6e0f9f51543387375
SSDEEP 3072:FNjrYXoNWjbiA+Wm9ZfeNY70MpcjbmJ5uX6TxPc8WbXgmrS:FNHYS6P+W2hRcjis6dPmbX1rS
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSans-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf
Size 589KB
SHA256 0e90d375cdb64f088a6a676eb560b755afa184e523fefbb9c33fdda4d7dd8461
MD5 e782457ebb0389715abdf5a9e20b3234
SHA1 e0d9ad78d1972d056d015452ed8dee529e8bb24b
SHA512 3ec030fdaa18f90bd8060466276c9ec49fd9233746e603d61a4f65a9a53e97e7b3382f8f913da17c48ffefc8adcf2be25f7e1c51f16555068b8f344a4e6dd961
SSDEEP 12288:3mQQRzdmpPEYDp4IF+lDNTz9bpNKmDykqoTmVy:3epuEYDpCMuOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansAdlam-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansAdlam-Regular.ttf
Size 91KB
SHA256 1b7b86711479fbfd060ed38abe1258246b4be2826760e6827287958218bb3f5c
MD5 ac01114123630edca1bd86dc859c65e7
SHA1 f7e68b5f5e52814121077d40a845a90214b29d41
SHA512 1c9ac878ba12f3de207aa9a7eb8c0239f769f9ae7475fec998e998192aa6900fe146039ac982612c6c0b7e5363355f2803d8f62e4787c0908c883ac3796e2a9b
SSDEEP 1536:Q/c3DudDfLDeUvJzRGq/Mms30oxRiHoKz5OOyRUo679AkF7yNQ+FJJJR:OAuhjzvJzRGdRiIK1OOyKd7dF1+FJJJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBalinese-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBalinese-Regular.ttf
Size 128KB
SHA256 194e110cb1e3f1938def209e152a8007fe5a8b0db5b7ce46a2de6e346667e43d
MD5 12764d72c2cee67144991a62e8e0d1c5
SHA1 f61be58fea99ad23ef720fbc189673a6e3fd6a64
SHA512 fb670a7dbb57465d6384cd5c3a35356e94bf54ac4cb7578e67c8729ff982943b99c95b57f6059443e3e8b56d8c8d2cfc6e81ae3a1cf07306f91c3a96e4883906
SSDEEP 3072:ppljnZNPA3M93AFT8fTaF9zjN1ymmtHpSTUqTTM:zltZA8KafTErjiJST5TI
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBamum-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBamum-Regular.ttf
Size 224KB
SHA256 0282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084
MD5 f0b22427c3ddce97435c84ce50239878
SHA1 a4a61de819c79dc743df4c5b152382f7e2e7168d
SHA512 ff2b22e58597d0ba19562c36f03cf83b5f327eee27f979c9ff84fe35a21b1fc9234f21fdb35fb95f933c79b9cf7760328d29b31480153da59a6576cf5f7f544e
SSDEEP 6144:NNP99a3pfUJUpRm3tLrvg3Bq9cIIdXXjwdzdwRhChZhe:Xra3pp83hg3BbdXXo+hChZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBassaVah-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBassaVah-Regular.ttf
Size 7KB
SHA256 8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
MD5 778376d22591a4a98bf83ac555ddf413
SHA1 608172ca18450b4cc61ff6cc155f66cff55c5bf9
SHA512 e895a03374a3d3da04554cd048191722652ed4f1f7cc91639354843138ce26aea6c7f2da0ecda47eb76bcdd61a0315cc2e35e080a5953c24d82f4e94ce4aa260
SSDEEP 192:SUSro5KGKl8Td+FRoUQMpkA3SAROJFpMlce5TcRpc+98FE2J6DZu/njg5G:SUSskkoXo4pkA3SAQs0MJAcg5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBatak-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBatak-Regular.ttf
Size 21KB
SHA256 cff9f0e51e7f1d95934cac31d9ad43ba453ee308c7b46a27803dc7e2e6c3adef
MD5 9390ee64243e5335b79e33e5e8311341
SHA1 c8d4b3ab79f6b12311eb4e4da29e709e583b5870
SHA512 ad7b23dab247c5c71298c5023bc58bd1d00160145558d86ab75dd37de1f1017540bac544cd9bf1cb2802d19d2973c0cf189d05a980777de886ffb552ae923bc0
SSDEEP 384:rje+SjKioEEC5GvhBHXUqxgsvzRE8EYME++pXiToab4KQRXEzD:HWjKiUB3U27vzRToo0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBengali-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBengali-Regular.ttf
Size 198KB
SHA256 9f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba
MD5 7b5138efef2c02dda9cfae9917cd913f
SHA1 b44b58f354c4a68e119df226f01ad763b2d1025c
SHA512 47e4cfd2218c91080fc4ccc3ac13dabe9efb7c96b981d53577177fb062973b9fad0052edcf2b0c663ff3b7a1d9e38e96586c93cb72618d64344b96e3df13204c
SSDEEP 6144:JVh9sfLfq0/WUqPyHy/4EXBtTYn4myGmyd1cCbflj2zdrSubYXmdXKOtZ:Jr4Lfq0/WUqPyHrExtTYn4myGmyd1cCu
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBuginese-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuginese-Regular.ttf
Size 7KB
SHA256 bc19f17d7f6e8f280c2cc95ef6d1b67fac25becfe98722f482039a4d84f3c9ba
MD5 bd4c30081a164037311e8712423c5bf2
SHA1 2a13bc7987ca34644b075c1fe197ba293b4ca527
SHA512 2a20d113b73cbca311d08dba40dcb7f8ab9d5383f7590b61b785070f77204db9ab163557a420c6c96ede815643f82ffdf75bc59b5802284779ff237616734c66
SSDEEP 192:5DLJNpZ9pHEzN602UgEL12LjIkq08+98FEwOfNlv:5DFNp7pHEh602hExLxq6O1lv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBuhid-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuhid-Regular.ttf
Size 5KB
SHA256 328d80e11e7f65f9b6e4bac12de32b7ce42154301c2a14ba92155e32e05939d6
MD5 34699ac8824cdb6593b4dbef605dd6b2
SHA1 22ff82e35cbb1ac9053f767f404ee351786fe0c2
SHA512 fe714d5d44c6c2f4f96b4349bff301a67749bcb084ade3a0270723f1fa6bd6061193c4d782cb663d63e2c32cc809f33a8114e2e0bc6915de2b04efc82b5de673
SSDEEP 96:41fNtuByOrPLUj/fAxTMeCcqPnlGYKTRlDLQDwhAsh+98DhDAAADhAtQqrJm1OaX:CPOfvTMeCcqNGNFlDLx9+98FEAAOCqrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
Size 690KB
SHA256 ed1d55d6f52963ca4918c15c1f69f26ad14519a1e7e08f8a3669b0ce13b4a30d
MD5 dd3e5d568d6ec781aedf5e1705f283b8
SHA1 b21fda9c83707f5baf2eceffd4496339f6d145c5
SHA512 4076331b5a25587006a97b41c181d5561e5c717a8d9b55f54152e4a014ee39bf809af560dd81aa8fd0df05ff5e3280e1891cfb0aadb944faf3ac9c4beac87e01
SSDEEP 12288:meHxOsFcvL2c5mCcN9XrIdvupR/VUMZB/qnh6:m1sFpc5mCcN9XkUphOMH+h6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 43KB
SHA256 9c9d86ba3a50de00dc85ea5c04b7e1e65176405732b5c95e9f099411b051fa34
MD5 f6392fe326919b1db4aeeb8aeb6820de
SHA1 0ff0f4c214344eabad089ae87d26a94cafc722dc
SHA512 4bf9a7d0f89f5f5cad63e18fdb798c247b9504157f9ab771ac6240fd8cbde8e948aaa0764ec312807bebe0139afd20a964d4bdc77b96420236ce68240f53d0fd
SSDEEP 768:BzOk3s6hvnS5YRtWFaEsCI40lLodavTqXGHvHa8NTO9:BX5hvnS5TPrJkTi
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 1.4MB
SHA256 a6bbd19e33a9d2b539c798261ed400c74b239527ad17109ad549a972bd6cebd6
MD5 eb388726725c57ccd28cad1dccee33b6
SHA1 35429d8a907b07286a884c0e9cb2fcf78e93f8a1
SHA512 dc9aa4f26a86fbfa6caf7d476e59975fc79da314eab8cdf5e2899d681e8b9d3767e531a656471e3ea2129f4e688ad1e0c472eb5d20ea8a8ed94c00d9fc66a48f
SSDEEP 24576:Amh4168eo08mGAvbfjZSS5Z+KFB6B2q1xWF8qRLCUQFYD:1hKd0fGA4m7FB+2cWF8qRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.5MB
SHA256 4625cfe435db2f7d9d2bc722a2e8e7b46c6f74a6f5954cca2daa2c94c3265f7c
MD5 43cd2b07fa362a2f229968c0e834093f
SHA1 2f637aec344e6bca1df4a51cb05c0cd10d3d6dc7
SHA512 c32c982ac99fead6b8d7f0f3bad200c4d54f5d5b7187ea44ec79c9361603ac5438ace94bd5fd614f41f49684195b7777de195848dc004d7c7a1d02a29c6ae5cb
SSDEEP 49152:cesSNouLmuGa/nPXeeqjsb03HP9IhLD/3hKNXqW5gLLb1fgSZrTdPxT+foMSsly:cesSmuL1G7I0voJogr1/txTDMSe
MD5 SHA1 SHA512 SSDEEP

Submit Download

nssckbi.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll
Size 472KB
SHA256 4b8e24aa607e0b5982d2854a7609e72cab0bc5415c1bf8162de541f279de2e11
MD5 aa0cb6c47b9c739dc8a4647b79787cfc
SHA1 908278d0aa0b43c2d9fe18c1a1596056e715df11
SHA512 b92e377c4e7f39087625704c174514d1e87c5ff462181938ba979ad753e381771b8838febee99c276b66bd73b3e6d6f1473d59d2062ce3766b1a431ed3c5a6c3
SSDEEP 6144:+fRv6lYqcNdC2uqSC9uB+uf1hhcteXISPiCpfViGJ243xjZTZdOp4VoA6MQS6BE5:+UlYDM2uqSCo1nwCp724hjMpT+QSQ6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
Size 18.4MB
SHA256 f13a14ef31a833630c85557906706e6af92f3c4f0a42bba8103de4b21a12b22f
MD5 8fd3941992025a21c4822049d0e06e63
SHA1 4c9f80b5e14ada595e59257bd833c716d73042a8
SHA512 a9ea6315b782e28d8af2db746867c786b6fd4a16c1393db98309d705437eefda0fdb1be6fc8ac745ea6a743d3672f6c47dced7de2836846383b78ff962240f8d
SSDEEP 393216:vKXyGnUssmmGRuNr2YGw0eU4fBfjl2khGoqoU/OYh4Jb:vKyGUtmJudXwjWl2CGqqOYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
Size 288KB
SHA256 16ef79086baa56c10589ec945fa3760ddbbbcf4061612ad4a6992bfc24cd26ba
MD5 cbcdffcdcd140b9ea3dc081ecfcbbd46
SHA1 ab44ac9317b82edb780a2167da6d459b9a423a74
SHA512 5e46812981012f29011161740736c35d356d49b23062cf8d73a5f1ea1b08f107e8db29086881d9c556f7783cfab9d580bc67b0ee813192ddea28ec2f46415129
SSDEEP 6144:pDr45fcKhXkJaBkL29ZPRI27cCmJwhhYz+xnNk:br2/mCxDYz+xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
Size 829B
SHA256 20cca11f5c092266dc5e0d341faa0b0f4ded7d2bfa2536e72549c1a575c6cea2
MD5 5b7a8b460dddfaaa05f82921739faed0
SHA1 bdad3c8682a82008a1b3d388da116d5660a1a918
SHA512 d949e000c476144e9776372e1c674c6220d2c398d5092308645bdbe3a3dca9dda11f17a6c954f888a83fb3b2d6f80cd0a355828ed2cdcd942446d99ebb9ff2b0
MD5 SHA1 SHA512

Submit Download

memory/3276-735-0x00000210A3CC0000-0x00000210A3CD0000-memory.dmp

Download

memory/5248-588-0x00007FFA751E0000-0x00007FFA751E1000-memory.dmp

Download

memory/5248-770-0x0000022901720000-0x0000022901750000-memory.dmp

Download

memory/5248-589-0x00007FFA75350000-0x00007FFA75351000-memory.dmp

Download

memory/5468-799-0x000002460A990000-0x000002460A9C0000-memory.dmp

Download

memory/5640-800-0x000001B592D20000-0x000001B592D50000-memory.dmp

Download

memory/5996-802-0x000002B430C40000-0x000002B430C70000-memory.dmp

Download

memory/6036-803-0x0000015FC1260000-0x0000015FC1290000-memory.dmp

Download

memory/6132-801-0x00000218E8E60000-0x00000218E8E90000-memory.dmp

Download