hxxp://torproject[.]org

Resubmissions

26/02/2025, 19:08

250226-xtny4szmy88

26/02/2025, 15:21

250226-src2lstqw58

26/02/2025, 15:20

250226-sq83natwc1

Analysis

max time kernel
1437s
max time network
1440s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2025, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://torproject.org
Sample250226-src2lstqw5

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
60	4052	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	tor-browser-windows-x86_64-portable-14.0.6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	firefox.exe

Executes dropped EXE 26 IoCs

pid	Process
2012	tor-browser-windows-x86_64-portable-14.0.6.exe
4624	firefox.exe
944	firefox.exe
5900	firefox.exe
4544	firefox.exe
1524	firefox.exe
2388	tor.exe
5208	tor-browser-windows-x86_64-portable-14.0.6.exe
1392	firefox.exe
5828	firefox.exe
6064	firefox.exe
3464	firefox.exe
1056	firefox.exe
1108	firefox.exe
2732	lyrebird.exe
2968	firefox.exe
436	firefox.exe
888	firefox.exe
4724	firefox.exe
4216	firefox.exe
2708	firefox.exe
3876	firefox.exe
5696	firefox.exe
5208	firefox.exe
4660	firefox.exe
2196	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
2012	tor-browser-windows-x86_64-portable-14.0.6.exe
2012	tor-browser-windows-x86_64-portable-14.0.6.exe
2012	tor-browser-windows-x86_64-portable-14.0.6.exe
4624	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
5900	firefox.exe
5900	firefox.exe
5900	firefox.exe
5900	firefox.exe
5900	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
4544	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1524	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1392	firefox.exe
1524	firefox.exe
5208	tor-browser-windows-x86_64-portable-14.0.6.exe
1524	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
5828	firefox.exe
6064	firefox.exe
6064	firefox.exe
6064	firefox.exe
6064	firefox.exe
6064	firefox.exe
3464	firefox.exe
1056	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
3464	firefox.exe
1056	firefox.exe
1056	firefox.exe
1056	firefox.exe
1056	firefox.exe
6064	firefox.exe
6064	firefox.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tor-browser-windows-x86_64-portable-14.0.6.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000_Classes\Local Settings	mspaint.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 789500.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\Downloads\12 sets.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4052	msedge.exe
4052	msedge.exe
2448	msedge.exe
2448	msedge.exe
1196	identity_helper.exe
1196	identity_helper.exe
2092	msedge.exe
2092	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
2732	lyrebird.exe
2732	lyrebird.exe
4888	mspaint.exe
4888	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe
Token: SeDebugPrivilege	944	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
944	firefox.exe
944	firefox.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
944	firefox.exe
4888	mspaint.exe
2452	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2168	2448	msedge.exe	85
PID 2448 wrote to memory of 2168	2448	msedge.exe	85
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 5112	2448	msedge.exe	86
PID 2448 wrote to memory of 4052	2448	msedge.exe	87
PID 2448 wrote to memory of 4052	2448	msedge.exe	87
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88
PID 2448 wrote to memory of 412	2448	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://torproject.org
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8666546f8,0x7ff866654708,0x7ff866654718
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.6.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.6.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  PID:2012
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4624
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks processor information in registry
      Modifies registry class
      NTFS ADS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:944
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2508 -parentBuildID 20250206184358 -prefsHandle 2476 -prefMapHandle 2468 -prefsLen 21011 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {d2cbf1fb-595a-4603-8088-010ce65e6de7} 944 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5900
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2320 -childID 1 -isForBrowser -prefsHandle 1912 -prefMapHandle 2384 -prefsLen 21821 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b3cb9176-9bfd-4ffb-b323-f1935d93261c} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4544
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:6aed51a6bf9fa92e60b9f143cb52940cd6d1a0fbc1337ee58e04745343 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 944 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:2388
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3196 -childID 2 -isForBrowser -prefsHandle 3172 -prefMapHandle 3168 -prefsLen 22591 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {9c3a685f-001d-42c8-bf25-8e3c00bdb69e} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1524
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3768 -childID 3 -isForBrowser -prefsHandle 2112 -prefMapHandle 1944 -prefsLen 22667 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {e91990cb-7fda-4b23-a025-d45d1814a8cd} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1392
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3564 -parentBuildID 20250206184358 -prefsHandle 3524 -prefMapHandle 3480 -prefsLen 23093 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {7e2fe051-fb7f-4aa7-b192-2d232d4278fb} 944 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5828
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1944 -childID 4 -isForBrowser -prefsHandle 3976 -prefMapHandle 3344 -prefsLen 22517 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {55c36726-46fb-46ef-84c3-68ae47b5b8fd} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6064
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3624 -childID 5 -isForBrowser -prefsHandle 2396 -prefMapHandle 1660 -prefsLen 22517 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {526ed416-9220-4c49-8a83-37f3e0c7b925} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3464
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4028 -childID 6 -isForBrowser -prefsHandle 4036 -prefMapHandle 4040 -prefsLen 22517 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {0f1978b9-c9cc-43d0-9093-e6bbd4cbae35} 944 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1056
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4440 -parentBuildID 20250206184358 -sandboxingKind 0 -prefsHandle 4420 -prefMapHandle 4416 -prefsLen 25640 -prefMapSize 252221 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {dc0b0786-90be-4ed0-8363-53978f0d09ec} 944 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1108
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4868 -childID 7 -isForBrowser -prefsHandle 4656 -prefMapHandle 2236 -prefsLen 25902 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {7352c676-d273-4d02-89ff-414b5923f74f} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:2968
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4780 -childID 8 -isForBrowser -prefsHandle 4892 -prefMapHandle 4716 -prefsLen 24563 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {478210d6-6e36-45ff-a6b8-467dab6e54b9} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:436
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3672 -childID 9 -isForBrowser -prefsHandle 4660 -prefMapHandle 4380 -prefsLen 26294 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {a8dd1468-5bc3-4d91-880c-0db132133ec9} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:888
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3092 -childID 10 -isForBrowser -prefsHandle 3644 -prefMapHandle 3656 -prefsLen 24889 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {5c78b949-2ec1-459a-a677-ca9ac7f0f7e7} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:4724
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2160 -childID 11 -isForBrowser -prefsHandle 3544 -prefMapHandle 5244 -prefsLen 24941 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {bf4021de-58b9-4b3e-8761-8d852b8339bc} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:4216
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3300 -childID 12 -isForBrowser -prefsHandle 3164 -prefMapHandle 3216 -prefsLen 26346 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {272accfe-467e-44bf-8407-2ec233195ffc} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:2708
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3512 -childID 13 -isForBrowser -prefsHandle 1380 -prefMapHandle 1004 -prefsLen 26346 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {d22beffd-5ded-4c34-b4e8-f35d5cb3cdab} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:3876
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3204 -childID 14 -isForBrowser -prefsHandle 1920 -prefMapHandle 1968 -prefsLen 24941 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b713600c-c76c-443e-81f3-04641f521093} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:5696
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3164 -childID 15 -isForBrowser -prefsHandle 5372 -prefMapHandle 5368 -prefsLen 24941 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {196d7835-66f0-49f1-8566-d62f974880f1} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:5208
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4384 -childID 16 -isForBrowser -prefsHandle 5636 -prefMapHandle 5144 -prefsLen 26445 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {8241a545-7d5f-460e-99ed-8a658d9edb8b} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:4660
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3520 -childID 17 -isForBrowser -prefsHandle 5776 -prefMapHandle 5604 -prefsLen 26445 -prefMapSize 252221 -jsInitHandle 900 -jsInitLen 234780 -parentBuildID 20250206184358 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b51b8401-b9e7-4559-86be-04e061523551} 944 tab
        5⤵
        Executes dropped EXE
        
        PID:2196
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.6.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,109841121185306562,2251490949438392553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4220

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6072

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\12 sets\12 sets\6920-Evan Trenor\748861c7-3325-496c-8252-6c46c1965f55-photo_id_1-ET DL Front.jpg" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:1532

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189
MD5 fe6fb7ffeb0894d21284b11538e93bb4
SHA1 80c71bf18f3798129931b1781115bbef677f58f0
SHA512 3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596
MD5 1bed6483de34dd709e03fd3af839a76b
SHA1 3724a38c9e51fcce7955a59955d16bf68c083b92
SHA512 264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 969516b3bb7553ea9ab237a7354c4305e02f2e121760a93ef6d3ac7c1d6cadb7
MD5 8876c6a66596fac6ddbce4f82010825b
SHA1 dffca4d51e898c9ec9133857ae73c6ebf44b2ae0
SHA512 c78a7b63daf5bad847fbaf887ade0a105b00586faca8290a7f3264495060c2e073acb2e7e1971dfc629bc11f6faf1f75ae38bde17f3134e53b38c32d1b7cccd5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 016518955b597e6e1ec45cf9c12670f5ae86bc394c5adfdcf6cdc5ab1f4c00ed
MD5 d164a6a2e4683561c5395c18fd21e111
SHA1 03effd4b497a36494dca46c7036721378b967278
SHA512 004217f682b5e1d90c5656b00a3ab028f6132a745288d99b53dc7d657c5cc7741cabab26fffe8014dedbe8294c3ede4607d65af9b67c3e055ff1360d0bf4288e
SSDEEP 96:n4kvxm/gQYmq21mYyaHwpvWMoiVmdeHfeMt3+UWQyV+VDCziEwb:n4kEFdsYyAGWMXp3+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5afa87a25ff58521ef5b5eb85e1538a2eb837f1dbbd66e81df80e44360c979bc
MD5 ecc9bf37f4ca8adec91bdec2c46a4c8a
SHA1 6e63aec7b8c0eec9576c418fd08ebc04aedc320f
SHA512 795cf5320ad6efab16bda6b19441b286684aad2d0cd342306aa547d25a813b929c60fce08213cc7f5bd2df779f02ac158a6a8e55a5f25eb495ca344bcbec3923
SSDEEP 96:n4k8sQhxm/gcmq21mlgHwpvWMoiVmde1ug1jfnFMt3+UWQyV+VD7AiEwb:n4kh6dslCGWMlughu3+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 022aba6299e453e8540c5f0bf35a2d5e942dccc49aefa90d781455bb77013e89
MD5 c56ce14d952c3648b4de922edefa0476
SHA1 a47a0f4889e20cceb63c1a17b1c19868d1994eec
SHA512 fd1316204c9d8de51845d0870fe36f51e22fa7a2821ed8a28dfa22a76466d0978a59bb6b35bc3c36d3414445f0a99efcf211cff99631bf5d3409861aabddf5df
SSDEEP 96:n4kmsQhxm/gcmq21mlgHwpvWMoirR5mdeHw2jNflzt3+UWQyV+VD7AiEwb:n4kX6dslCGWMr1w2pX3+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 df9feab6303752cde060a95f43b6cea7706467626dabe01581ea5ecef5c7ecf0
MD5 f12fcc5f032e69d1925ad62553daf164
SHA1 32e8e8ae945e5b4834b360a589840bdf3ea9a324
SHA512 af09c120c930e001ab80dfbdcbe1eb0bd3b616f3e094608ad3fd41229787ba370ca28d1d779e5b2a3652ef66cb65f0fbeeebcb6910c608ec3696ce00525620d0
SSDEEP 96:n4kvxm/gcmq21mlJHwpvWMoiVmde1ug1jfnFMt3+UWQyV+VD7AiEwb:n4kE6dsldGWMlughu3+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 894e84bb20f8e2ed337332d20581cb964ef7f9f17ee93a7bfd3a24c3613a4b84
MD5 80ab7fd3dd2015930814d5b553291e8b
SHA1 c6c45eecafe2d108e1bb814f079b857541fdf009
SHA512 656c2cc2de3c24edc19366405e524f0771db0adf95758cc12a5c9a619c3c5f431d79243f933e1e44ec1a9d78461be6e9dd7dffc2a8f2509678b58219a64754c0
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582af3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582af3.TMP
Size 204B
SHA256 d3b09fd5dba5619027d13cf4206d10d099ddef7f9aa159dcdf1ca79d2ee4ce68
MD5 5559e4f7985a81c95abf34bb28ff8279
SHA1 4d8cfb09a2771f158003dd26737a484f45966523
SHA512 8db071f52457a1bbbeae895083aa86e0fc8110e1a8c0b74d758a0bf7f1d6697dace6e26ef98887ab52e06a2e099d990a08a5ef6588253fb7bfbff1ed4c0cc05c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8a6a56988ab12663162ed91b52f7674995ea292d841c7d010d9b6274f2719780
MD5 f72aa0dcccfb94d80e06c2790f925031
SHA1 f61002c1053a916fe9617290c5ea9d2b21b05389
SHA512 10b6729d35501699b315598cd0e601553dff9e2a4f8a293577560cca72e1cf60c8dd3ed6ebb7443885455b3c71c5e5690ac9c2fb8f746c9239fad91080b684ab
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupn4fode2RU2Puo3UPfJmpKO:A9iIxuERzA83h09RZxYnt5jEPwMppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8584ac47db2022ae69edcae8fd276ad3263573287dd1d865169311e8fe4e8ab1
MD5 092dd9deb690c32482db3cbea3892f12
SHA1 d064bcc8d1b2642fe456faafebf3b28bffc4ab41
SHA512 7844dfd9fd35fce7f8bc649ffad4d7476af068226429cf963260bca21f4c80aca204f8ede3f835b2b54431ffb570bb57ebcb844fa9f2d4d632bdbe5d7765169c
SSDEEP 384:19iIxuERzA83h09RZxYntE3LWXqTaPwMppW:+IxuERzA83h09RZxYwJTa4MppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 56d81fe58496eb807bd43e169fce5ec87d6af8a89d5082d2fd52fc90d89fb79f
MD5 8cfc682cad7ae5a05d198f99ae1fb70c
SHA1 f5df29970c4a7f2f45a4b441cc821defef360a41
SHA512 826ebf88b5273e609a16a6828d100df8f7ea46bf853f9ac9441333328e831144f0374ba69c355bd149d6da5df6c2721e213f34a029d64540594fd44617a43cd8
SSDEEP 192:OoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupn4foKe2RUgSsuoRUPfJmp9:a9iIxuERzA83h09RZxYntE3vaPwMppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5da5dca35908066cbb4842433d92ec77d0d3b7eb64a975bf107d5c22e441b314
MD5 a405ad884efd1f2b85f3d9b8ed297ec5
SHA1 2f13daf07030a7a8fe15ad76488b160184daeaba
SHA512 46e4b78d54e5cf64f96df80721c13e36c818e00da76d12bd2aecae309c941d22bf7dc78990e47ca684d39ca3e47d98e167f22e2eedbb38d6b3072dd7c89ea229
SSDEEP 384:79iIxuERzA83h09RZxYntE3LWXqTaPwMppW:wIxuERzA83h09RZxYwJTa4MppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2bbde06652a14ec814fa3dc28dc9eae5da3e325315bc842f83507c2a4dde6902
MD5 ededf480bd0629c30ef662a306c202cd
SHA1 1b89ef19ffb7fdde0e3ca4058502927304e1fa05
SHA512 cd0059c40765a210f081a0d1ff6abc4b5174b86f36f93fca3d5f118bcda46722343b1743303f528fb306f2b28c0a727e290a95793342239aef3c4928bc87f4ae
SSDEEP 384:69iIxuERzA83h09RZxYntE3LWXqTaPwMppW:ZIxuERzA83h09RZxYwJTa4MppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3900845356087cfe6c518d63ae4d45cafee0e7d0165cd925b97d85d9e71b995c
MD5 81517a2a5da6b50e1d75048093ded265
SHA1 553f4ba7b2f21243c369b3fbaadc8f79c335f408
SHA512 dce6c8f3bca4d06aead41fabc3d5454c657ee3e280da72bc01c37f69be86e2c1b9ea92d87340b41d924a9fc402bac3eade9e663e2834b9bb7e4868f00bab46fb
SSDEEP 384:X9iIxuERzA83h09RZxYntE3LWXqTaPwMppW:MIxuERzA83h09RZxYwJTa4MppW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6975.tmp\LangDLL.dll
Size 7KB
SHA256 81726604d47b192620bcf90d6e42ba8ee8b4c54935b0081655e08247d6b6c675
MD5 9888fb6b91a680305b2a3e7b71d6561d
SHA1 4a7935da38f88e9f74f425078ee39eb6269c4e63
SHA512 f50755e5624bfc3a60a23a7dda012509c1e31d9772d6a0ccaca88e32ae8d4602e10e38003d78b1626464502db7ea7c47d772efb7b3ea7c3e2238bf3b9809f833
SSDEEP 96:BLAxgI+WdOH6gujSllqS3sjacsmauMOPN9FXmTEGMjxtRAOIxoAhrEoUK3EMbL:JRH9uglqScj0xKPNkMU4oZ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6975.tmp\System.dll
Size 24KB
SHA256 abb2613ff851b2cbfb61bf97e4eef9d4912abcb46e04774ad84812ab75d4dde9
MD5 d997606c77e880be2744c44128843d60
SHA1 92bb9003dc14ae03963f503e82a668877ca4295f
SHA512 714d7ce786e9fbb6f0d0e537a146a3a24aa79089669dd168b7c110dfba667fa7afb794b3dd2b93fa76e1d1771af3347a0f568cbb0fbcc8d9755de9e6e54382b3
SSDEEP 384:GkIcqkRsMp6YnItwvDs/pMHJr47dcf+tqO58L2TanLyyI9zhBu:dI7lMp6z8s/gr45cf+tjG6and
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz6975.tmp\nsDialogs.dll
Size 13KB
SHA256 c7f2afe3a2424e71563e69d862dc027d299d84fba4ac1ba11e593361daec0a80
MD5 bd0d7a73d0fc619e280372587e9e3115
SHA1 0cde473dda5d4fda8190e6460f3229cae2571af5
SHA512 914983bfa336f9ea019bf5dc9ee403af56a6c7c1d88b8092609e4026a3377daa6ef9a8e51a93537f6769ae165c264763645a363fb6a89f8689f59caf985c18b2
SSDEEP 192:YTs145dOYTwR6ChcSm+4wCCvZul55BUhU+Cg8++9Kd9:YTh5d586CubuvZulL++9Kd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bookmarks-2025-02-26_15_9NY0QEH3wdl_35San_S-6NRWHNYdqULu2J3yBbcrT-s=.jsonlz4

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\bookmarkbackups\bookmarks-2025-02-26_15_9NY0QEH3wdl_35San_S-6NRWHNYdqULu2J3yBbcrT-s=.jsonlz4
Size 1KB
SHA256 472a5f5e586aa5b8bcaa9505d45f46f80c2a859a1f080ad94de25a1f45fdcfd2
MD5 09a84f954eb9369d9bffb027250e6340
SHA1 8e9cec64988c3604eecce83b8cf5a613b6ee39b3
SHA512 1a685122dbbcbcc61613e27b2f415de57e2cd7ebfd6f6fb997e325d592c34516c930323328b2d981159dca18f35cf405afece5ca696b560e5a68110d41111f5f
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 eaec709a98b57cd9c054a205f9bfa76c7424db2845c077822804f31e16ac134c
MD5 c58234a092f9d899f0a623e28a4ab9db
SHA1 7398261b70453661c8b84df12e2bde7cbc07474b
SHA512 ae2724fc45a8d9d26e43d86bcc7e20f398d8ab4e251e89550087ace1311c4d2571392f2f0bed78da211fcb28766779c1853b80742faa69f722b2c44c283569fd
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 7cea48e7add3340b36f47ba4ea2ded8d6cb0423ffc2a64b44d7e86e0507d6b70
MD5 b1c8aa9861b461806c9e738511edd6ae
SHA1 fe13c1bbc7e323845cbe6a1bb89259cbd05595f8
SHA512 841a0f8c98dd04dc9a4be2f05c34ecd511388c76d08ca0f415bfb6056166d9a521b8bc2c46b74697f3ecdac5141d1fe6af76dd0689350caca14e9f849ee75a8b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf
MD5 7fba44cb533472c1e260d1f28892d86b
SHA1 727dce051fc511e000053952d568f77b538107bb
SHA512 1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 81c14432135b2a50dc505904e87781864ca561efef9e94baeca3704d04e6db3d
MD5 1c3c58f7838dde7f753614d170f110fc
SHA1 c17e5a486cecaddd6ced7217d298306850a87f48
SHA512 9f6e9bcb0bba9e2ce3d7dabe03b061e3fda3f6d7b0249ecf4dbc145dc78844386d047ee2ac95656a025ef808cd0fc451204dc98a1981cf2729091761661a3b49
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 182B
SHA256 86bff840e1bec67b7c91f97f4d37e3a638c5fdc7b56aae210b01745f292347b9
MD5 7d3d11283370585b060d50a12715851a
SHA1 3a05d9b7daa2d377d95e7a5f3e8e7a8f705938e3
SHA512 a185a956e7105ad5a903d5d0e780df9421cf7b84ef1f83f7e9f3ab81bf683b440f23e55df4bbd52d60e89af467b5fc949bf1faa7810c523b98c7c2361fde010e
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
Size 245B
SHA256 69add43c45c18dc4e408430c5730ae23138d014d197ba53001a7c5bdeaf3f539
MD5 e41a948534f6e10c71ad031683c27930
SHA1 3869650897d89fc67cb56bc0707bd3edea1b673b
SHA512 b10e7ea994cc96246a857d8f277650c73b50aadbf6bbcc84cdc39e2742aca845f9abdf77bc722ac4351dd669fbf902a76d97c5824be898728466798a4a006c35
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 16KB
SHA256 df8bff379fa3e609651b1e16399fdcab9ea2f0046aa0900ed26fb592956ccae0
MD5 5d8fde11d9ca9e8b3c92eea6669cdc97
SHA1 e7507ed3a67c9e437276e2efcf90f239eaa9005a
SHA512 0a46036f9cbd75398c1f55071905c7a415b10432cb5855cf07aff53ee8f4c800e4eff40a591477e55cc652fee0a5857dd640af9692a4742617bcdd44bc8120e1
SSDEEP 384:dw/OlPkOOXTOw/qnv142nwriL4HExL4HhL4HaIL4Ht:gOlsCu2p4kp4Z46K4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 92e76679570014cdcb37d9f01a5c102bfaff23fd2fd166bcaaa625ba042d3e77
MD5 afdf001f236e70297b41e86d2322b615
SHA1 de23c57f8844007cc6d55305b805c4a45d470615
SHA512 d0aaabb078ec865137a0d88312145eb428b4a6bd16d43bab11f307cbcbd600af9bd10ee940e9672edec33692bc4ccf0b2983a3b9ed879ca8fffd00650e3027bb
SSDEEP 96:xHTTeqGqZtbzvzoz1zEkLWPEnj82XMjD8QCBw8/UQ:zRZtYnjBQCBw8/h
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 a0e87e58ba492c837bad3fd08b811e3534ba5d407cbfae8db481bf396a046c62
MD5 20e3e61e46e7bf46f6112f111b450c7d
SHA1 9f74be446ffacbc819e5f46ebd5604fabdda622f
SHA512 7eb15c2bd5bec86529f8525358054151d746ca853e9f9442ee1e12d9a8f2783c9b7b848a5d8de14e284bc021404d10dcc3d811ed3d4b56fc8448c85ee6dde824
SSDEEP 96:xHTTBuqGqwtbzvzoz1zEkLWPEnj82XMjD84CBw8GQU+GS:zJRwtYnjB4CBw8GQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 075a65d34916fdeb19aa14fab2cd37c66127d3e4f8099eea39c00aabc8d56ab2
MD5 b6ef5a10cbbdfcbb5b2353c23d7b3646
SHA1 60688c122bb13a814f74304070f9e55ca2005c6a
SHA512 ae8322a547cc5f99bdad699de251e26dd4fa37b20fdb233833b4ac8ad3dd8ba0f2fc665689a12151e03fe0ce23f4f780186438e15b10d02ae3405cac2993452d
SSDEEP 96:xHTTeqGqvtbzvzoz1zEkLWPEnj82XMjD84CBw8/U3:zRvtYnjB4CBw8/+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 730B
SHA256 3540c37f6ffce2acfd980d5b13cb491ec8c7bffb09b0a9786cf65cc833e3c3d9
MD5 595ba3f3b7b333c7d0111eac7f602e0b
SHA1 4dbb1bbf73c4ed1f264005f668e0b5ee5a6c78d0
SHA512 c75469f044046042dca58a7257b9134114e152540b975c39537f582d07d0dcc1cd3f1915c432d269cc55a2fa9edf082015692e6275560157aa1c3417e13c3c85
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 1KB
SHA256 68c32062c8bed60f2623cbc81c86b61d4df5f8828f84f2a7ca9186b72289252b
MD5 e7c242a16a66f6184e5da3f571c9cb40
SHA1 3d1f779b42947e04c72d106484387ddcfc0eb525
SHA512 be1e9179dfacc67d0ebc47c1dfae12245e67e900bcd8e9b2e58f425a1548a6268aeb27803ed727c43268b01257c2482ab68e634732e13e8fa72ac41a72bfdb89
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 2b3286d1d1fe7fa9dc1e7a950442bde7b4868b55600ed49928f953de4e47f88e
MD5 ef2b1304ac55ded8460c161fa7021dd0
SHA1 1e38e3fbc1c0df9ba5bcd79bab4123e34a1593b4
SHA512 df242777a2896e00ddf09697b3ad0994d725ea8cb1bb88ebcaad8ffb25335b6f445e30f3741f51e036d315f074dd0db4d9558917bdc9e7a2a91052a81a5571ae
SSDEEP 96:xHTTeqGqwtbzvzoz1zEkLWPEnj82XMjD84CBw8GQU+GS:zRwtYnjB4CBw8GQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 f30283f154c299e42548c1a7e5ca905fb90937519bc771d137e535f7af3b8058
MD5 466d1855573997effbaa3f95abb47d58
SHA1 317d25172f2a5b1b20bb1f1217bfb5b1cb4a38bb
SHA512 cd726c2f4ddb6415b27f3104e6c5c8e6a06d9926411222a9e4882314b3bf77aae27eca84c422d57d32ffba69e4c56fa5a35c53a9093a39ac04914a7d1d583883
SSDEEP 96:xHTTLqGqwtbzvzoz1zEkLWPEnj82XMjD84CBw8GQU+GS:8RwtYnjB4CBw8GQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

3647222921wleabcEoxlt-eengsairo.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\default\moz-extension+++666b772e-c180-4687-80e7-0cc36c1f22ed^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
Size 48KB
SHA256 963fbccae58b1a4284632f7bdab1ee4fa81d93c0bc18c4558db98960c624e382
MD5 6bfce849cd533a424cb270bc55f65e8f
SHA1 8e78573b7cfcce2720d48e1f6caba90bd5be5082
SHA512 603e968ad3f234a3a137b950e8c98e1ff59785459bab3852a1119c67fb3f704cd5fb509912d0e0420f8b2848c609a4511e0d9f24a0b0b53c282eb816dcb27188
SSDEEP 96:D16S6CKnqlizbxV+2xVeU7X2B03AEVR4/ehGbjMhKkheOSSP+fzp4CC4:D16S6CdFAWGAEVO2I38EBC
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 56KB
SHA256 9e0d3d39f0a97da922e9fa42b54e450c74d1b97b8e4fb5835b8f3ed2e108cedc
MD5 8370fb08e7774e32a807891ed2864c74
SHA1 8efc50bce62ba16f613949b5a924c5ab3abc6dd5
SHA512 ee4a2ff5720f2f3d2696a2a5cf725ee23c08cb3625a1f846aa4af124d8edba808aec00ab2adef859c7c5380ed08885a1fbec3058bf4e8d4a31fc2df35b80b2fa
SSDEEP 192:k16S6CdFAWvUrn6sGDAcllNaoLANAq9ErAc/RUfD/skrQqkwr7zAP+xOX3deCLn0:u6S6CrAWiIllNEoefDxJJTAz3Ey0
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 64KB
SHA256 1c19f568473b209b1da7a4f6129e1eaa7243df2f05b0a26ff63230a3d0ac0b80
MD5 4600bbe331dd369d8964300285eb09a3
SHA1 6b7c8ad315215f9438c1e83145f84cdbe1bab0cf
SHA512 6ed6b9a31725924fed99ba6b66e021968e565e8760ed009ee13aba1c61527e2efe3dc3739e598914b42fd23fb0ab6699768c158cae2996fecb83b284aaa0b06f
SSDEEP 384:h6S6CrAWvIYtFaY3p6x37FlNEoefDxJJTAx2cHLeHcFlpy56+Hy:h6S6CrAWrFaY3p6x3yZcHLeHcAXHy
MD5 SHA1 SHA512 SSDEEP

Submit Download

profiles.ini

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
Size 103B
SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
MD5 5b0cb2afa381416690d2b48a5534fe41
SHA1 5c7d290a828ca789ea3cf496e563324133d95e06
SHA512 0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
Size 2.9MB
SHA256 31a7854dff1f12cb3e4b06108ff8f7bcf8e01aeef6355d8f634c038fdf97ad50
MD5 a970f1a8da6a4cfa28485e4745b592e7
SHA1 9f0aee55371808f6e084f2d5ef7037c9d364fea1
SHA512 eaeb493c91f6a6528c69e21fef552ed5b2477c9246933cb4d0733f798faf5db40033d16aecc868676196c627c14f63fa3f1e285c35bb8aba50d648fd81520e05
SSDEEP 12288:0RaPi7oUQnvor9Oa4/OO0djciKV/NlUvnJOvKhJsKU14E7OZnhdhz4L/t:3P1a9yR80MHhzUJ7Ofdhe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
Size 8.3MB
SHA256 ba3ea3d0048e101fa445511aa2697dfcddddbf1730c3335042283a7d3a39acec
MD5 8fa02bbe1b4883ee7fedd256c1010962
SHA1 92e6aa366a01d15b75fdfac2f219b9e48ab3ea8f
SHA512 9ccd63d4fe55f5f1c3b2bb06e4fb70992b83259db62b39494ec51251f3075d8673b0356dbb2a32c8d56456f6016dafbefd5fd7ef040dccfd0e4da00430b179b3
SSDEEP 24576:lBZB+ZdOBPsu2B3BD9gr+1Br0nLPUhfHpOBnSwKB6fBqx9h48eMBUJLuWjcYvIbx:27Byt+qO5bC2
MD5 SHA1 SHA512 SSDEEP

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
Size 25.9MB
SHA256 08547ec3206e8bb77ef8a0f7a4b2ca8352661dd3b389111703b612c05a8300f4
MD5 32801e3819731827c0f3c6bb65054e4b
SHA1 5385c20f6f04e368524a9c8ed6a56ded8539d407
SHA512 df513299414793772e683ec3a4e81b1ffbc56fc7fb0ae4af92a3da0edf1b7e3a6944aae6bcf60b013b1334c50f0aff341c14703c1d2a6144968b71962718dd57
SSDEEP 786432:8jIr7u0yalb596m+kq9U7wS96wKOkz08B9TYJ6lzyQ:Nuxat5Ym+kjbZpkz0cYklF
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel-prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
MD5 SHA1 SHA512

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
MD5 SHA1 SHA512

Submit Download

{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Size 957KB
SHA256 f9639e63ffcfc352036de00e4ff6694bb0ca65a0bb8fbd103bd08f32dc1ff31a
MD5 62c2b654a504e5e5ae9e51319b9e6005
SHA1 b8f185129557bf8cbef1640f9393f4785e95cb63
SHA512 87e7c642fb4dfee08a8f1136de61fa5c1a4ea5588c31492c0e6e76f378466e4a891ba7aecb7c20e2a772cb4ce6d6ae85863906ff80597bf7d43fe1423578c405
SSDEEP 24576:qZ6seSFl1vcqJhdsc08io7QN8DF9ip2rVnntKxw26xvw:OzPFl1vcykpvqO8DipoVtKxovw
MD5 SHA1 SHA512 SSDEEP

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.7MB
SHA256 85d8fb8fcfdaaa51b8db3aabe69b52beb091e337bab31e397b803eea71f48266
MD5 3b615ec63cd44f67f1d435e4f6a24602
SHA1 a5c44a1409231e13528f0912efd6f26e682e8c9e
SHA512 1acfb75153dc8db80241f82a3d6d7588989ebb34741ada3e5981f9d6fed9aaf19bf18a8e332a2d99186a7c32d62d64140d5bb2edcdde63b3591907698277b910
SSDEEP 24576:usT0iC6uXqRWF7rInzJ+0nRhm6ve/WwdEwthsRKTCRr:usgiC6WqiHe7nRhm6vmNSwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

000_README.txt

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
Size 296B
SHA256 14014e6904c0a496afaf2a7ba6f63926d16d4e8695862d3af439954434765de1
MD5 b699245ef09504ebc6f7851bcd00524c
SHA1 7aa6fe2d8496f4d23f401d5867ebd174f6c1ff61
SHA512 d3a56cb9f0e9fa3fa4db87bf5e8eabf78cccc297ffbef3cd1f1969621c1bb50eda42ae8ccd40ffb06aa69fecad18c0ba8f800b501f1446b8aa454d2df06521ec
MD5 SHA1 SHA512

Submit Download

NotoNaskhArabic-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf
Size 239KB
SHA256 2d5d78e9cc27d7193926c7e460314c9da7dbec1268494dbf117adc53c171ac06
MD5 75a26f9ce250f3ba740481374081ff86
SHA1 7841512f9c97da85e037e03b27adeaac2024968d
SHA512 7922811ec908ef6a39bb9e33927275393df06bfe5da22b75d924efc0e13e399ba495b00fc245c5a8ee3885e2f1de212dc366aee387b15a87d8726f69cad2690c
SSDEEP 3072:nAxJbl0JUcv9nKuECSuaDJfc4BjoxsXlZ5LfnLBvJ6Byvn9S4Njb:SJmJUI9mfc4JoxOBTBvJ6cvn9vNv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSans-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf
Size 596KB
SHA256 61b72eacd39533f0e5916cbb458abd7b3cf870667f63f3069dac2a75aa0317a2
MD5 5263051e028cb83196239d4a3cb188a3
SHA1 e33d657a2646a020fafed4ea6dd0c05033e1ee02
SHA512 902dd869779426736ad61419b0a877d0019a9201e08386cbd456c6dcf11ce2bc98819560797b2bec8960e70afaf38979ebc106ad745aceed7b079e618547ac58
SSDEEP 12288:diowbUE4QRjqxpyEoMJ0zwHXAUGTo0R5law+3yqhAyyZ1:wWEP+OEoMJ5XwQApZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansAdlam-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansAdlam-Regular.ttf
Size 91KB
SHA256 4b51541536a7b28142a4571c16dc56e386c05f345ac9739ef8599d8ad4ed5e54
MD5 b0329c36c9ecf880e0cd488f55f1cc52
SHA1 6dd4397372c50052f8150826627f70424bff5b14
SHA512 333e405ea669de0cf1704be2fb5ba36571037af78440ff362569770214ef3ed1dd4c06b1b5cc0a2362c85c66876d090105369693b077552203a8d80c18614924
SSDEEP 1536:pc2CHeUvJzRGq/Mms30oxRiHoKz5OO/nUo679AkF7yNF/qRFdDfL0:mvJzRGdRiIK1OO/Ud7dFMqRFhj0
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBalinese-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBalinese-Regular.ttf
Size 90KB
SHA256 cee58a184e7e00c4332087ac01870a69ac52fd5fa17ea3783ac728c945af1827
MD5 01881a746a50919e34f507ab4930c566
SHA1 038e0d8b49222a83f007035629b5384709e04229
SHA512 ec5fe6139e4ecdb409c44a06462a3eda6b63505926602bfdc688d2aa3b8bbd6e4b570cf5e60bb505df0b62fac9ea6d52f84ff88ddf54079a2561faf7b0a959be
SSDEEP 1536:WZ8f+Ze73TMudp8ALOyLRVv+zQ4KzbYoxZ2TYwYE7gy:Um3TMudp8ALOyLv+zQ4UqTEE7b
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBamum-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBamum-Regular.ttf
Size 224KB
SHA256 0282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084
MD5 f0b22427c3ddce97435c84ce50239878
SHA1 a4a61de819c79dc743df4c5b152382f7e2e7168d
SHA512 ff2b22e58597d0ba19562c36f03cf83b5f327eee27f979c9ff84fe35a21b1fc9234f21fdb35fb95f933c79b9cf7760328d29b31480153da59a6576cf5f7f544e
SSDEEP 6144:NNP99a3pfUJUpRm3tLrvg3Bq9cIIdXXjwdzdwRhChZhe:Xra3pp83hg3BbdXXo+hChZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSansBassaVah-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBassaVah-Regular.ttf
Size 7KB
SHA256 8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
MD5 778376d22591a4a98bf83ac555ddf413
SHA1 608172ca18450b4cc61ff6cc155f66cff55c5bf9
SHA512 e895a03374a3d3da04554cd048191722652ed4f1f7cc91639354843138ce26aea6c7f2da0ecda47eb76bcdd61a0315cc2e35e080a5953c24d82f4e94ce4aa260
SSDEEP 192:SUSro5KGKl8Td+FRoUQMpkA3SAROJFpMlce5TcRpc+98FE2J6DZu/njg5G:SUSskkoXo4pkA3SAQs0MJAcg5G
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
Size 979KB
SHA256 93441330776d9db42a8dc2020953e1126ec1cc9776334abe77f785fb43470c2a
MD5 4dedc3da64f17cbc60ee1aac2e85f345
SHA1 f25867f74bcb1aa72f9a0acc745ff8dd38a6985c
SHA512 55d04931a725d3d402a8f31ad6a704b4793bf4967dedf38047fab07e314bb36e637ea8a4ee322e32658441dacb7cf75fee631dc276ea5b186df55177aa1a4bda
SSDEEP 24576:J/I3Krn6pRsqVZsa6GMPNjldIn9NSm7e+hjry:u366nsqVCInSm94
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkcodecs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
Size 10.0MB
SHA256 f6cdadfec0915db9b2c6bdab392afe0267ffa29dbdcc5a8f60d43a5a4b14a7e4
MD5 b52544f5f0b161b52b28857ad7e8ddec
SHA1 54dd3977d335c2703179a593c29808f84f25c948
SHA512 df79e96dc27f56ecfb11c066a885abe4c32fffccdf9a694f832be1b47aa8e83f8699131f48694471c888651907e00521602cab261a553db4d843fe5d78d2dd38
SSDEEP 98304:rRkQUc42qGfVezsEsEsc2L125mqaphFhzXroAWFrr2fgOOtVpaxQg9IeY:rWRJ2PfVeD2L125mz7hfgOOtVcxNRY
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 493KB
SHA256 8ff6c2249c80c949f39e6f97eec77404c1259c6e86a9511e58a41d789e2cd222
MD5 be97dae810895735e59bea2d77cd08e4
SHA1 b0f8dbb59e335f6b47746cd001f902d41d088584
SHA512 7acac3feb199da60ed3b782c54535389f07af0719ec46c384c0d58cfdcd8b6ee8a83c51d09dd2745bdf68420d451c59925f5dbe156f87b6aeab74b02c2b0bc8c
SSDEEP 6144:TlQc86BjyA1CGQzhLd4WX2BqPKePxMigc8w18Y6amYeVreMje3rT74C7O4Afan4t:TmzUmVyE2B1igm68InsuWvbho
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 1.4MB
SHA256 dbbb7f7f0f861960ad7b252a99bc7aba48b91a45e8d4404f4b086df63d7d0967
MD5 03ab717201fa486b3d3ae927fc47ba3c
SHA1 90b7ca51458398dd3dfc77d0bb9f4c968192d950
SHA512 4ca5a11eb2f01f03a25e04c8e40143518e42cc7b04c907ee90e78fc70f43449de208631676cfe07cfd97c9409626aee4fbe9099ca7ddd32d683821392b3a27b4
SSDEEP 24576:4IfL83gTfrds2V5laOSpBlsqctA7BikWF8XR4PU:4IfL8Qbr629aTBlsqcCDWF8XR4
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.6MB
SHA256 5b9d19d5d8a52dd56f14e0cd374c90e60e374e9e48c2e2d1b5944fb23bb15be0
MD5 41a130f8f8301e6852d127cb2358ad03
SHA1 fcd7a00ebedbc47655d716dab96c4dc92be31e50
SHA512 890d60a08c23fbfbcc93bcd0932ed51146dd59b218b457c165d43e4c391d716b4ceb594f18f6353003a08932e5ea96520ec28ec32091ea2a92753e4210c1bd73
SSDEEP 49152:jHI0cIo7lSAWwqXIAkYmb7RcCXJMfkSxrfjpg6s7WIsxU6MSXa3a:jHIWfwCkP/TXFkZ1s7WIsMSKq
MD5 SHA1 SHA512 SSDEEP

Submit Download

nssckbi.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll
Size 480KB
SHA256 d59c84826514e73d70cce48aafb6f7b186814a35cd09c67d6b0cf011d4e6975a
MD5 f21dbe7111c99f88c70754b1888b8564
SHA1 479d1ada3f59f928b1cf3d08c33f6ec78c52a787
SHA512 042e27be6ea4fdab5e9d21947a9f6dd760e8801ce33042d9d51af3f601fb07ef1f930f65013cf3576c8c4a98d2ee56c5716f9d3389448f82d86e2ea59684ef8c
SSDEEP 6144:AE0VRSMgZBrMPNysqViGJ243x208cGLbTmNxpcmoK6MQ297a7FwzakL:AEDMgZB4PN424h2DvL+xp6EQ21iKak
MD5 SHA1 SHA512 SSDEEP

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
Size 18.5MB
SHA256 a6654f886c224ef2f9052512c1d1d79d061116a7dfdfc344ebc16a235d70fd93
MD5 4bcad1a18b44fdaf04a3074b18e746a5
SHA1 774bc24c4597bf30db23aac852953b55be6204cc
SHA512 8b68e47de7a68064a8e9a3a5f4d09854fa3ce1daa2d5f9ff654ef9f23620c7d2d5e97d2824d225c3fcfb59a580777469df56add0791e1974589531c717ac8812
SSDEEP 393216:q50H4tgtDnlWWKfmaIwPnAnVU0fjfdkIEhLQFIq+ZSAh4J:MDtgtDlqBIw/mCAkIEhsiZSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
Size 301KB
SHA256 c4bc68971a9824532d867afcf90f58f99888d898e0df65dc0fae4d895dc0f0b8
MD5 3f9f256dea31ce0905711eb4b5ed3527
SHA1 fca5b48674b67ed3d813129f8399ca86e14a1632
SHA512 404ed09fe239d9e80ae1653b20222014b50fd48dbb19afd027f9341195ebcdba6700a9bdfe04eba54721207222fb4dd451e5868506f228ac742ad853bdfc934c
SSDEEP 6144:D4+micnndbURVKDxVcLn6FXhi0/Yz+xn:DM9nnd4/gkDOx9Yz+xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
Size 829B
SHA256 ba76816767198795f813188da8cf50d05a7efc016b801b38293e8fba80622502
MD5 bf752240a48fc9c4b6b85b2f17afd9a7
SHA1 ebaf2a13dcdeb18ef6315548745951b747529282
SHA512 e8e609ec1f2068464786ade65f347662359d76daeb99e9c7f521f949c8bb24ff74858e919663d603cc3a860d3d11a6330a8eefda5ba959047e1f56fc391e79d7
MD5 SHA1 SHA512

Submit Download

memory/436-995-0x000002A503300000-0x000002A5033CD000-memory.dmp

Download

memory/944-736-0x00000212CF380000-0x00000212CF390000-memory.dmp

Download

memory/1056-843-0x0000023AE7840000-0x0000023AE790D000-memory.dmp

Download

memory/1108-863-0x000001C54C200000-0x000001C54C2CD000-memory.dmp

Download

memory/1392-837-0x000001F13A900000-0x000001F13A9CD000-memory.dmp

Download

memory/1524-836-0x000001FD97FA0000-0x000001FD9806D000-memory.dmp

Download

memory/2968-993-0x000001E72CF30000-0x000001E72CFFD000-memory.dmp

Download

memory/3464-842-0x0000015F99000000-0x0000015F990CD000-memory.dmp

Download

memory/4544-721-0x000001C8F13B0000-0x000001C8F147D000-memory.dmp

Download

memory/4544-607-0x00007FF874550000-0x00007FF874551000-memory.dmp

Download

memory/4544-606-0x00007FF8733B0000-0x00007FF8733B1000-memory.dmp

Download

memory/6064-841-0x0000029588340000-0x000002958840D000-memory.dmp

Download