hxxps://torproject[.]org

Analysis

geolocation tags

asiadelhiinindia
max time kernel
602s
max time network
604s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
24/11/2025, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://torproject.org
Sample251124-rc8z3afn21

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	2880	chrome.exe

Executes dropped EXE 56 IoCs

pid	Process
3420	tor-browser-windows-x86_64-portable-15.0.2.exe
1676	firefox.exe
4464	firefox.exe
5056	firefox.exe
3952	firefox.exe
5136	firefox.exe
3028	tor.exe
3104	firefox.exe
3456	firefox.exe
5704	firefox.exe
4372	firefox.exe
2632	firefox.exe
2892	firefox.exe
6968	firefox.exe
3756	firefox.exe
4448	firefox.exe
5372	firefox.exe
6340	firefox.exe
6368	tor.exe
6416	firefox.exe
3288	firefox.exe
5080	firefox.exe
4944	firefox.exe
6824	firefox.exe
3628	firefox.exe
4604	firefox.exe
4732	firefox.exe
1460	firefox.exe
3200	firefox.exe
2724	firefox.exe
5776	tor.exe
7008	firefox.exe
4352	firefox.exe
5328	firefox.exe
5212	firefox.exe
3628	firefox.exe
3676	firefox.exe
5788	firefox.exe
6060	firefox.exe
3388	firefox.exe
6496	firefox.exe
6688	firefox.exe
3696	firefox.exe
2280	firefox.exe
1716	firefox.exe
836	firefox.exe
4756	firefox.exe
3540	firefox.exe
4008	firefox.exe
3188	firefox.exe
6576	firefox.exe
3840	firefox.exe
1716	firefox.exe
3404	firefox.exe
4572	firefox.exe
5628	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
3420	tor-browser-windows-x86_64-portable-15.0.2.exe
3420	tor-browser-windows-x86_64-portable-15.0.2.exe
3420	tor-browser-windows-x86_64-portable-15.0.2.exe
1676	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
4464	firefox.exe
5056	firefox.exe
5056	firefox.exe
5056	firefox.exe
5056	firefox.exe
5056	firefox.exe
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe
3952	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
5136	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3104	firefox.exe
3952	firefox.exe
3952	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3456	firefox.exe
3104	firefox.exe
3104	firefox.exe
3456	firefox.exe
3456	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
5704	firefox.exe
4372	firefox.exe
2632	firefox.exe
4372	firefox.exe
4372	firefox.exe
4372	firefox.exe
4372	firefox.exe
2632	firefox.exe
2632	firefox.exe
2632	firefox.exe
2632	firefox.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
41	ipinfo.io
110	ipinfo.io
111	ipinfo.io

Checks system information in the registry 2 TTPs 3 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.2.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134084666678481756"	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tor-browser-windows-x86_64-portable-15.0.2.exe
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2631871815-168557882-4268713161-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.2.exe:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
2984	chrome.exe
2984	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe
Token: SeShutdownPrivilege	5528	chrome.exe
Token: SeCreatePagefilePrivilege	5528	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe
5528	chrome.exe

Suspicious use of SetWindowsHookEx 63 IoCs

pid	Process
4464	firefox.exe
5372	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe
3200	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5528 wrote to memory of 4004	5528	chrome.exe	78
PID 5528 wrote to memory of 4004	5528	chrome.exe	78
PID 5528 wrote to memory of 2880	5528	chrome.exe	79
PID 5528 wrote to memory of 2880	5528	chrome.exe	79
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2884	5528	chrome.exe	80
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81
PID 5528 wrote to memory of 2904	5528	chrome.exe	81

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://torproject.org
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff878d8dcf8,0x7ff878d8dd04,0x7ff878d8dd10
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1884,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2008 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1976,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2508 /prefetch:13
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4168,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4184 /prefetch:9
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4980,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5156,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=5680,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5864,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5144,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6052,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4988,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5328,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5972,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5080 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5100,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=212 /prefetch:14
  2⤵
  PID:4028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --field-trial-handle=5072,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4776 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=4716,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5836,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=7004,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=7056,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6924,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5288,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:5860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6744,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7256,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=7380,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=7068,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=5748,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=4728,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=7136,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7108 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7240,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6716,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7492 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=5252,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=7460 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6996,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --string-annotations --field-trial-handle=4504,i,7166404154636610099,680484817321628988,262144 --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:3044

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4456

C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.2.exe
"C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3420
- C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
  "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1676
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Checks system information in the registry
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:4464
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 2548:26446 -prefMapHandle 2552:275601 -ipcHandle 2596 -initialChannelId {aeca542e-ee52-4c09-b128-1c3b02114081} -parentPid 4464 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5056
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2384:27031 -prefMapHandle 2104:275601 -jsInitHandle 2032:242716 -parentBuildID 20251112110000 -ipcHandle 1860 -initialChannelId {5447de78-08d2-4509-a198-c9341d66b9d8} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:3952
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 3008:27355 -prefMapHandle 3012:275601 -ipcHandle 932 -initialChannelId {90175ac2-2a15-4f96-b23d-6c8385888f80} -parentPid 4464 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5136
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:d16f8c7fc3b7ad5160a47b4b8043929af46d5261f79ed8edb0f17cfdf4 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 4464 DisableNetwork 1
      4⤵
      Executes dropped EXE
      PID:3028
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3300:27772 -prefMapHandle 3304:275601 -jsInitHandle 3308:242716 -parentBuildID 20251112110000 -ipcHandle 3316 -initialChannelId {20fe0ef8-1ca2-45c6-8d13-6e564f5bec57} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:3104
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3400:27848 -prefMapHandle 1888:275601 -jsInitHandle 3100:242716 -parentBuildID 20251112110000 -ipcHandle 3308 -initialChannelId {25891254-d8f5-40ab-94f9-28a2b3658c1e} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:3456
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2956:27614 -prefMapHandle 3024:275601 -jsInitHandle 3308:242716 -parentBuildID 20251112110000 -ipcHandle 2472 -initialChannelId {928d8c47-36d6-491b-8d39-e4343c58e3fd} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:5704
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2896:27614 -prefMapHandle 2880:275601 -jsInitHandle 2884:242716 -parentBuildID 20251112110000 -ipcHandle 2292 -initialChannelId {23b74031-7366-4f83-937c-a2717211031a} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:4372
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4072:27614 -prefMapHandle 4076:275601 -jsInitHandle 4080:242716 -parentBuildID 20251112110000 -ipcHandle 4088 -initialChannelId {55b6aba6-d1f5-4d1c-814d-05156c355461} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:2632
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -sandboxingKind 0 -prefsHandle 4540:29863 -prefMapHandle 4548:275601 -ipcHandle 4420 -initialChannelId {90fb57ac-4328-4f98-9079-defc0e5c1950} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 utility
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:2892
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3024:28919 -prefMapHandle 2956:275601 -jsInitHandle 4740:242716 -parentBuildID 20251112110000 -ipcHandle 4748 -initialChannelId {0476291a-57ac-4965-ba71-6268202b41c5} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:6968
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3356:30518 -prefMapHandle 3340:275601 -jsInitHandle 3344:242716 -parentBuildID 20251112110000 -ipcHandle 2360 -initialChannelId {885b600b-184f-4b5d-abcf-96be5d50f540} -parentPid 4464 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      PID:3756
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Executes dropped EXE
      PID:4448
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5372
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 2560:28330 -prefMapHandle 2564:277082 -ipcHandle 2608 -initialChannelId {67316b97-c010-44f6-834b-d5876a373974} -parentPid 5372 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
        6⤵
        Executes dropped EXE
        
        PID:6340
      - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:8170bda9ba548f7060aaa4987ac2ba81daa3843f2be60a7507a51256b7 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 5372 DisableNetwork 1
        6⤵
        Executes dropped EXE
        
        PID:6368
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3080:28442 -prefMapHandle 3084:277082 -jsInitHandle 3088:242716 -parentBuildID 20251112110000 -ipcHandle 3096 -initialChannelId {4d952b49-0afa-444c-aa20-33d7e8ec284d} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6416
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 3308:28442 -prefMapHandle 3312:277082 -ipcHandle 3232 -initialChannelId {b29b78f3-37c3-4843-b039-8643e6500f31} -parentPid 5372 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
        6⤵
        Executes dropped EXE
        
        PID:3288
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -sandboxingKind 0 -prefsHandle 3288:28515 -prefMapHandle 3280:277082 -ipcHandle 3744 -initialChannelId {9a650009-aeae-44d1-a345-8a104f01c4d1} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 utility
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5080
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3248:27269 -prefMapHandle 3244:277082 -jsInitHandle 3240:242716 -parentBuildID 20251112110000 -ipcHandle 3748 -initialChannelId {772a8fd1-f0c1-4a54-bec3-d556c5f26c76} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6824
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1572:28694 -prefMapHandle 1576:277082 -jsInitHandle 2120:242716 -parentBuildID 20251112110000 -ipcHandle 2104 -initialChannelId {9f2bd482-0a20-474c-b71d-dba7e6b86fb2} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4944
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1840:27417 -prefMapHandle 1352:277082 -jsInitHandle 1356:242716 -parentBuildID 20251112110000 -ipcHandle 1896 -initialChannelId {27c45bbe-0c88-4b4e-8b1b-9d9989ed763a} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3628
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4624:27417 -prefMapHandle 4628:277082 -jsInitHandle 4632:242716 -parentBuildID 20251112110000 -ipcHandle 4596 -initialChannelId {029fd88f-da8d-43ce-8a99-7ef8a4dd2961} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4604
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4808:27417 -prefMapHandle 4812:277082 -jsInitHandle 4816:242716 -parentBuildID 20251112110000 -ipcHandle 4824 -initialChannelId {080fe3ec-f033-4923-8248-e196dc67d45c} -parentPid 5372 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4732
      - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
        6⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
        7⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Checks system information in the registry
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 2524:28305 -prefMapHandle 2528:277180 -ipcHandle 2560 -initialChannelId {2507534b-d61d-43e6-884b-b11e4652b07f} -parentPid 3200 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
        8⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:fa0efa42c16395df6026197b0eaada70e500be961080eb691243a229c4 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 3200 DisableNetwork 1
        8⤵
        Executes dropped EXE
        
        PID:5776
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3208:28417 -prefMapHandle 3212:277180 -jsInitHandle 3216:242716 -parentBuildID 20251112110000 -ipcHandle 3224 -initialChannelId {5ab44ef5-4b8a-4b31-b551-ab13a8a48171} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7008
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -prefsHandle 3424:28417 -prefMapHandle 3428:277180 -ipcHandle 3436 -initialChannelId {ce337101-c15b-46a2-802d-05c565346708} -parentPid 3200 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
        8⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20251112110000 -sandboxingKind 0 -prefsHandle 3092:28515 -prefMapHandle 2228:277180 -ipcHandle 3060 -initialChannelId {82e6f264-07e6-496a-8f67-938fcad34edd} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 utility
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5328
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2296:27269 -prefMapHandle 2288:277180 -jsInitHandle 1992:242716 -parentBuildID 20251112110000 -ipcHandle 1544 -initialChannelId {a73bcc2a-0b8d-4439-9ea0-1da9049caa08} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
        8⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4024:28694 -prefMapHandle 4028:277180 -jsInitHandle 4032:242716 -parentBuildID 20251112110000 -ipcHandle 2272 -initialChannelId {a3a5e9c5-a9d1-47c3-b738-570d306f044a} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5212
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4976:27500 -prefMapHandle 4960:277180 -jsInitHandle 4988:242716 -parentBuildID 20251112110000 -ipcHandle 4992 -initialChannelId {c60e614c-61ce-443d-806d-1abf1a56d99e} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3676
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5168:27500 -prefMapHandle 5172:277180 -jsInitHandle 5176:242716 -parentBuildID 20251112110000 -ipcHandle 5184 -initialChannelId {bffee88f-d136-4d18-b91f-f4b457c90f80} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5788
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5356:27500 -prefMapHandle 5360:277180 -jsInitHandle 5364:242716 -parentBuildID 20251112110000 -ipcHandle 5372 -initialChannelId {b7e3ac55-c67c-4744-9de6-2bbb8b499f25} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
        8⤵
        Executes dropped EXE
        
        PID:6060
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5596:27568 -prefMapHandle 5592:277180 -jsInitHandle 5588:242716 -parentBuildID 20251112110000 -ipcHandle 2348 -initialChannelId {db4a5d9d-9918-4869-8b36-d625f20429fb} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3388
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3916:27699 -prefMapHandle 3920:277180 -jsInitHandle 3924:242716 -parentBuildID 20251112110000 -ipcHandle 4752 -initialChannelId {7be32c6b-601b-44ba-a54b-8653b727570f} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6496
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3112:29321 -prefMapHandle 2952:277180 -jsInitHandle 4164:242716 -parentBuildID 20251112110000 -ipcHandle 2408 -initialChannelId {162a3fb3-a596-4131-95b2-d4b01de51a9f} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 12 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6688
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5096:27869 -prefMapHandle 5100:277180 -jsInitHandle 5084:242716 -parentBuildID 20251112110000 -ipcHandle 4460 -initialChannelId {416fb0b2-b62f-4948-8de2-9dc3902e5970} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 13 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3696
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4148:29321 -prefMapHandle 4072:277180 -jsInitHandle 4036:242716 -parentBuildID 20251112110000 -ipcHandle 3124 -initialChannelId {8972bd80-fa20-4be1-a1a6-3e9ff0f6af98} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 14 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2280
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4060:27869 -prefMapHandle 1372:277180 -jsInitHandle 5932:242716 -parentBuildID 20251112110000 -ipcHandle 3736 -initialChannelId {4230fffb-0aa4-4f0f-8c65-225f6c2431ef} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 15 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1716
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008:27869 -prefMapHandle 6012:277180 -jsInitHandle 6016:242716 -parentBuildID 20251112110000 -ipcHandle 5224 -initialChannelId {c5e35066-cdd9-48c0-9b74-a222ace1c5b5} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 16 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:836
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6008:27869 -prefMapHandle 4984:277180 -jsInitHandle 6000:242716 -parentBuildID 20251112110000 -ipcHandle 5052 -initialChannelId {3bba9107-17ec-4631-96d3-6422f0c0e008} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 17 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4756
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5856:27869 -prefMapHandle 5848:277180 -jsInitHandle 5832:242716 -parentBuildID 20251112110000 -ipcHandle 5940 -initialChannelId {ecc361a2-796d-448e-970c-f64327a3600b} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 18 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3540
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4076:27869 -prefMapHandle 4080:277180 -jsInitHandle 2412:242716 -parentBuildID 20251112110000 -ipcHandle 5992 -initialChannelId {066a95c0-b3a8-42e0-88de-987f21036490} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 19 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4008
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4288:27869 -prefMapHandle 5960:277180 -jsInitHandle 5936:242716 -parentBuildID 20251112110000 -ipcHandle 5040 -initialChannelId {06fa929f-041b-4879-b6e8-2ff7240a8e46} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 20 tab
        8⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328:27869 -prefMapHandle 2272:277180 -jsInitHandle 5044:242716 -parentBuildID 20251112110000 -ipcHandle 3112 -initialChannelId {42fba01b-a4c2-4eba-897d-2ea3b58a7467} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 21 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6576
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5192:27869 -prefMapHandle 4652:277180 -jsInitHandle 4656:242716 -parentBuildID 20251112110000 -ipcHandle 4524 -initialChannelId {75485e00-6442-4d6c-bf60-a47ae340aa1f} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 22 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3840
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5500:27869 -prefMapHandle 5496:277180 -jsInitHandle 5492:242716 -parentBuildID 20251112110000 -ipcHandle 3740 -initialChannelId {7c196a57-e03c-4d81-8455-f015c1a3551c} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 23 tab
        8⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012:27869 -prefMapHandle 5416:277180 -jsInitHandle 5440:242716 -parentBuildID 20251112110000 -ipcHandle 5776 -initialChannelId {989457d8-9d82-4f8d-bd0b-176fb0358267} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 24 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3404
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468:27869 -prefMapHandle 4476:277180 -jsInitHandle 3988:242716 -parentBuildID 20251112110000 -ipcHandle 5480 -initialChannelId {76ae31aa-1b1e-4d93-aa1b-2cb9b4768799} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 25 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4572
        
        C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4584:27869 -prefMapHandle 4588:277180 -jsInitHandle 4448:242716 -parentBuildID 20251112110000 -ipcHandle 6040 -initialChannelId {c9bef969-f240-4000-998b-96e252554161} -parentPid 3200 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 26 tab
        8⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6cde1dd8ba59dcbadfb785156497ca51a4e4139fdaeb92a78eeabaa1603b4989
MD5 9bddd4638a15a1c44b0e5701111def2a
SHA1 4d7f3ad8bc9f33b2c6ae3e99ec9d6330eaf17b39
SHA512 0858ed2a9692e620189036a3b6deb3fe1b1bc5b7b7e4d4990e6aa78390213e18ef997bcb77f23b3baf50561e71181a36dd04a368a9e87d16e3bd3d4ce6a72e30
MD5 SHA1 SHA512

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 28KB
SHA256 69c2c33c20ac2362919f66ae14115d18a6c444f762d5f3938f7a4f441d63d2e0
MD5 352348537cb874b00926cfce44f95a4c
SHA1 f91fed411ef9148e439fcad0d7d0234ff80d0fe5
SHA512 190f3cf6dd2b57e68c91623346c1dede51464de75876913209964950e12cf3317380344bb40174ee364a015033dc7b019cd5e60f3eb1caa0c10ca544c6924391
SSDEEP 768:gmDpRF+WWZ9YaBN0KtApOz9JaEGldGcsCl//5Ev:5tRF+WWYa/0Ktz9PGldNzI
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 21KB
SHA256 1733baed31b981640f444f10c481438f46f52a0850b772a5cf2b0ae63924b129
MD5 ffefe8534ccca73bc3530bed9a877e88
SHA1 5b8ce6f61de19a969802df7495b9d19c66eda784
SHA512 ea0ace0ce952975fca7fd736b566360a06c6cd47eeacc9671f306068a1a1de93c0baf65ceced06de52f85df344433d45f4fe1703fb9332ce33e775122fc9b23e
SSDEEP 384:MC7k2hWImgKhXbfuLGUzc7IDkBxfe+gvQF85EWoOnvRzxUzw/1rXKEphkelSjeG/:MQkGWEKhrfdUzLkBgXvQF85E0UzE1+Eq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 84KB
SHA256 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
MD5 c9f5aeeca3ad37bf2aa006139b935f0a
SHA1 1055018c28ab41087ef9ccefe411606893dabea2
SHA512 dcff2b5c2b8625d3593a7531ff4ddcd633939cc9f7acfeb79c18a9e6038fdaa99487960075502f159d44f902d965b0b5aed32b41bfa66a1dc07d85b5d5152b58
SSDEEP 1536:YNhEyjjTikEJO4edXXe9J578go6MWX2xkj8e4c4j2ll2AckaXEP6n15HZ+FhFcQ7:uxc2yjx4j2uX/kcQDU8Cu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 18KB
SHA256 625b022a42ed5d9c39911e42050f4fd9834ea039af978b7716f7800ade95eb55
MD5 6cd956453e307bfd2ce4bfb0648b9f7d
SHA1 a43367193adc1258902e5b68ad0cda6cf0f9ff8f
SHA512 424b469ed5023a9a7ddbb28cd6b6ed10310da52c7089e656a5dba723be520aca5f43ad5b6749147fc8dd712c77a17f907ec58a52900515c02352b423f1abee4d
SSDEEP 384:++Xh+odHN1iZCdG9D7fWsju398xivi+7D7NYFuA1QvDHr/RxGkjkd/9jt39Din1/:TQodH7iI67fhxivbD7JgQv5xPjknZ3Md
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 115KB
SHA256 8997f247324a33c9b6e0683916138bcc27d2c2491cf5e9670bb9813334dc3075
MD5 a2b640a377d617d21ff362f973986718
SHA1 3e95dc1f0348c573ddf31fdeb47a2a02e65f8ce8
SHA512 d083ba9e99927eb264098a695605ce5d25066515eb837f122905b88a508c3cdc78f01e66ee71a30d2bde431987fe5eb1e07af840d57126c428427b9c417fee9a
SSDEEP 3072:LEVZv1NBk1ELn+oiibb+t0YI4WlLLbrE2ZjX+B+pAJpimtp:w31NL5bytUxHbrnZj+SUpiQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 67KB
SHA256 4490f15bcd903912985c78ba0b1d4abbc94f7eec240c8050685676d071b13d74
MD5 85bef1b86b877db4b17ea8bae3eb7cd3
SHA1 46d1f82f1ff4224130c6153a8a6db457477b7097
SHA512 88ae341fa16b5cc6b8558e88eb2d8c1e7cc309c3226cf403de6c13ff7fbb33562b916e2ebd32c31338c5bdad1cd2acae11b586ff5de86c0e9b2289886b249d71
SSDEEP 1536:3VEcoepVAgjD1zCpHa2zXr8w8Yjma/fuT187V:3naqM8w8YjTf5V
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 46KB
SHA256 5d879cac1ca0da0c78aae1cd5e893eabd4a39da426c0efdb5e0069defc706efb
MD5 7767f7d29e2a6b84d4cdcc7f27d1d5f6
SHA1 9a4040e4ca968554f67933ae5b5f73cfce3e31d1
SHA512 c194be5c2172c5238142d8f0235b2d8ff43cadea6b3386e5bfcf40e69b235a0d87deacf3aad8e6ce3a2a8c799e7340ef2f4593ae91e4bbe7a62afd4cba082147
SSDEEP 768:lV8Vcn9dmF3EP1FtNfZe+cSgrm3rnH+unaZUYzvlcrQ4W0vs:ch+P1jZZe+rcyrneJZUYDOrQ4W0vs
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 153KB
SHA256 d4346996ae6d15a192a2f144be8a94801eb2cdebad1f69ef61408a2d1968916f
MD5 cf0a56554b6c53fb7d5830ab8b3c3dcc
SHA1 efe68dc79550c8d8001d6a52444408126e4684fb
SHA512 39b7d5028f41300200a7727b819ad2d7e5d3055e3f458651e337058786478e72cc9a57c31d8cee932fdf88629aba7304ed33ae200162fb79064a59640f1fc1b1
SSDEEP 3072:0ysho8auQb7UT/IGFc27+782GmfIXegpGRDH9tQm1pbdquO:0lhx/Iqp2G2IXXYTtxrbAR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 35KB
SHA256 ee8f270437131ea283f365013f5cd2dc85aa4a18efd4bf16ec2166b5377b4b5f
MD5 74e1f0eb307481dde8792060052bf37e
SHA1 0cf4e3250cac5f46a5310d7e51c8bbcb3cbeea12
SHA512 28e313c754ee17eacf9aa92b0a4c5a556a2c77787cad65c435bf0228f076af67dd2087fbaf80de4457d2ee4bbb36ccf4c828af37b52dc66f9cdddc42fbdd52b4
SSDEEP 768:SHHXXpVGgi92xJdztbHoc36xSlNtXSCivckNFxDYkfPGnnIFWJo7zj:SnXHGg42xJdZbHHqxOCCivcIDfHoIwCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000019

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019
Size 127KB
SHA256 510129c6cc72a1040e0ce4f9280643e18dd5df9a74dbb3f6d112051d3cc27fb9
MD5 58e885ca295ed2cd1fb9d5572f0c2717
SHA1 c1af0787045d3cfaaa57fd903d3e054380e24242
SHA512 59c7f0adb297c0be4885b4e579807a6d480f15dfd20178df6353b6dd86b1ea3ec64ee38e0da279b9d67af4adf52dbdf09bb9e7121c7a675f105e6890217f7e72
SSDEEP 3072:QrfYl62EpnaphJOnQ6M7EDvy+XFU6E5ZVJx9XqDEw5gTUPEji8MEbeTh:QrfYlWaNOnQHga+VUpXx8Yw5Ie5Iba
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001a
Size 71KB
SHA256 c0b7cfb715e4b0bfbe547f8ff2d24f2318843f89acc47b3d6b278192cb3e4a7f
MD5 4b084e1cfae602193eeaa3da34f02cea
SHA1 0f9fd300e9171a5cf6cc1f8a781d47d7850aeeaa
SHA512 55b90b065747157d7487d55b20dcf2414963e9a21629e18120530aa8be300aa2bd18d3cc17ff3ce32dabbf0f67305b5930e9c9125998855eb42f20c92f0e5d98
SSDEEP 1536:t8HP0X/1oPDrDegafrr7R3brlx/Aq0v5uKO/qr3q+5v+M:m8X9afegafl3brQq0v5u5y2+5WM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b
Size 126KB
SHA256 c98fee5c10714bb763f203e9565afad2506cc3b9688e19ea43fe6b3401bf6567
MD5 61a72636a3ddeefecf348c47eedf4ba3
SHA1 0f0cc7fd89cbb95dd8c828cc2809fdae9a1a9888
SHA512 5159f7facc885f9ed879373e09d23c551d5b6eb3d79dc86aed75e554f6caece2c7ba3ab78e16e9ee54455cdc19deb69882e179ccd11ab6cd57eb997f181c7080
SSDEEP 3072:v6AnLjg/zSI+qAV7cWC0Ql+w+DYa+l6HQYaXxp1Q4D5AW5:iAnPJFRg+DYa+CQY47Dj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c
Size 126KB
SHA256 54ba4430a7698d33451bacfecbb4ebc422b9222bbe7d2f868d6d519199f8026e
MD5 b30417a49319495d58c9b1a689cb4478
SHA1 04d529dcc657636fd0c9fe44e88aba2f03db7e2c
SHA512 a4aa5734834b2e0200e4d93ab5d229a99c2f12475dca6097d580ee3444bdf0329d2ca82f836960ac48704130981bd383b6b32faf5c775aa554eb6993cbd76d15
SSDEEP 3072:YTh9ElY9o2qn7zCJj4+1mlCAGrqYUrs7fhIY+C:YThOlcE7zKOHGuYUEJIS
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f
Size 68KB
SHA256 cd7b01d97f01f86c28f73e2ec7cfce8696fba0159110ebbc6897dd0126e13886
MD5 61864ac2885ac343680934699db83768
SHA1 733e32e934c978a7a441be0e3d35a11aa5b2d758
SHA512 a8d7ccc92ab3d407b0e06601385256fec4a308d21438f2ce4b662713235b2742cac08c806165003aaf5f31833bd91b2ef5e2fdf46d3de4c15f0b3fb56ea445c0
SSDEEP 1536:0Ilg/iCogNmJqlgMIp2y39OIY2gq1VobIgalByNkd8h:0XGkla8yu2gqV0rCBkkd8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 38KB
SHA256 5eb5243d46537c7c91d1c83c33b7708fc9f0e43cc38c5180686df1880f559424
MD5 b6b61bc4febe90681a7105e8534a9eac
SHA1 d4a0add265277a3e690e2b24c09a5aa6c3259dcb
SHA512 a164ae0a5517682f80c7c7ad1cab11503f16e19bd40d8946200f44279c12e98abc16f96c043248c95ae8e668c88926addb0dfd0b4132568aa97f9f49e0aec83a
SSDEEP 768:yQ6Mwp09gZqeXRZOANOMsMVEO1UsumDHH9gt42HAWfI7lZ7:yQJK+UBhZ3N9sMVEO1tLHHryAR7lZ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 485KB
SHA256 0b81b51d5799408a1d9d763a78bb3fc7757aa5446900cca413ec9d3d24c388c8
MD5 95a6f2553932de6c922489f6b29b5b5c
SHA1 f3880bebd33adf9a2c91aa182b401ba9fafe0b78
SHA512 576b58c5a245b13c9eeadd23208aacf1b57720a16d203ac24fd86e192d79475be46977a5d4d7a640e905dd75c6da7a51fbe746db5d210504b1647e4fa3d88710
SSDEEP 12288:T1bAaG9rMzj1fDcjlDZpJHehhYt0HGWvMEqXfRABvCqWV2o:JUxozj12N+qKSzXfGBaqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000027

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027
Size 77KB
SHA256 a81a49ec43eac2d8e81636e4ad2054fe483197673caddf664b8e261a923e26f9
MD5 6e480bef790dc6fd86b55a4fb87ff461
SHA1 d7db643fc3179bb74f016e2e1615cd32ac16c5e1
SHA512 df4ad5089790bd662956a0fdad4f98c93614f6aec60a0c260783fbd17945238b803e71a82ea0af27753d722965f57e715cda14eb573692a9aa2c5c92bf0da8b8
SSDEEP 1536:988y8AoSl3PgeoNpHiOkpzguJ4XKeqc4tQD8uRnVoL3a8e6GZxM1s:NAog3PDom1zguSK9cH8kng3a8zGis
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000028

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028
Size 69KB
SHA256 a76228908552348d977015e310a96a50c6c9ee9815285409587b79830eb89272
MD5 711a2a6ca57bf73cecd5b05db5c4049d
SHA1 2d05e8712883d8c1a4009b7ec1af0f0c9b1b9fe1
SHA512 4e8d46b3aa9f8071bcbe987be9ed8b4a46a6528a7aa8c2ea08c533f4f54a2265c393a035af0cde4860df606299afc393504a9a55e686b023210166ab67a77f38
SSDEEP 1536:pAxIwRNnnjstJAk8NthGgv4g51IyvQ882fSKOAEcf3EtrLlPb0xyV4:pAIqnngcNd5BvpnTRpf3iXlPb0xZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000029

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Size 59KB
SHA256 917e9e6d133d0221be63154e83aafa8ae931d059ab2c28c5dbacbf0fedbab4f7
MD5 f8508de0a3269a0c3dab1d6a788f2fa2
SHA1 8963eea787995043118bfc9e0475a6e6c90d81f7
SHA512 03bf66e3eb11f7d1a67e25c8fea97ccf1e408f44228d6df770c65409a076fe8713bb008f0861c9d47ea8d66d4f78cf6f48718627cfc6d4f6e2ee5a93a47909c7
SSDEEP 1536:zththnmVivYnQ0HRyGSA/oJlEjKUjA5ebbP6EHp0a:5BmVvtRW4uEjKMAYfP6wpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0b150eb2f246495e7982a9d8f765994b08702ae17e1c4344c2c495aef090e02d
MD5 7ce91eaf4a2117fc6a9f48240fdc90c1
SHA1 effd877e304e829fa588f5c090d71c888b315ece
SHA512 cfd1e6851290163085141d353714229a5c5f4bceaedbc9a5811da0ddca613c8e11697abc472ea800a321387ed308b27390231ae623b33905151189922e87f295
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 624B
SHA256 2aa94bbffc8843d3406da7d4347c07ac0f4ca5b9273c8cf8a45b1c938fb956a8
MD5 bfae2149a4646b6693aa047a093fe3c0
SHA1 759700ab1b96e885570f9449f755b92e3393f74e
SHA512 67e9e81d3d678d07fbce3cd56b0a56dda4a8e452d2f83349fc703d2bde2a2eb590c7966a0f947641ef5f3c020ebd8f7f5128d344a7ce3f21536a287f3098cbd3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8f0213829681e65458932f5cdb94bfcb8b3c75b5928b0ecee41d015a38bc44cb
MD5 b1a7add4f7f3294f294c8198c5ec00f5
SHA1 ad5e5c01d1c6cf362105ca98a53287f1252bb4c5
SHA512 da2ee6f716935fa17f94b5ad155e4ff308a452ea5c7a628fa898738fdd4d04c9dc60280a8f10290fddea4486de5c50161c79756f8473c9e24afc60fa743ecfe2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 c16eef01158c466c28b35bbcb28518ce5d5e3128c21dcaa16ad0dce4eb67c12f
MD5 c1167fa27095d8946fce433c12b8f003
SHA1 0999b4d62625fada28d03580085665a7efadc7a6
SHA512 02bacd7463c01f235fd1d6254ef11ccb950d8a38b18bae10ae08deaf35dd80959bdc7bb3c2c94a3da01fe92f17e02ad84c613ee773b259812935b2719d35a0a0
SSDEEP 384:DIwFxmpNzMjkXJCJt3N+kdsjeTHVMq7u2HQgI0boPFgs6c4mtqdrjOkAdvNBXZql:AIS5Yp3b+9Xg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ec0c9f24b4ff5b03ba86ffced64430fa625571f1af97a3556ab3083f7b8090db
MD5 dacb542856f0977957744db342b63e4b
SHA1 a0d9af3feeb79b43267fe5cb110b76ac5732a7cc
SHA512 d8c772b9ed413f94732c29efefc7e2f39a1043dc28708b3503d34c31d75734c2078b1b86235dc0b81617237b4163f7241750ca27ce233a6ca9896ea79434eda0
SSDEEP 48:YALl9W2l2i12J9I9I98zAnzufc7zLsugCzsJ7stvsX8s7usshsalzsrbspIsk+/N:DIefQSKmcu2HC4Kn25Ycn/a0u78D3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 bf706b7899be4e73ba176c867fea8e8a5fdccdc3bce1fdd6bf3e11c8254029cf
MD5 bb9c7d40ceaec1ef1008785915395d41
SHA1 5ead6131e5c6e02bc640d46f771fdd19bd70fe56
SHA512 ae45c9d10fef721b57eb1929e37c36962944d5d19fab27a6273c5a5bf3560a8e2d086cc988a550c188b00e3f9827d0fb0d77cfb1107e6bf3c9e48306d00f8d1f
SSDEEP 384:DIefQSKmgMjkXJCJt3N+kdsjeTHVIu2HQgKpF1boPFgs6c4mtqdrjOkAdvNBXZq+:YI65Yp3b+9X5
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 4KB
SHA256 d4e60f59353812c93114bf4346323c5a3b789a7f03566df34f5628a1a3ababc8
MD5 ddf901286ae2f277680f44c63713b09b
SHA1 b56cadf3ea53de49b1b4c5e2f44e3e303c56f7f9
SHA512 ab373f999f159328e8fe78d8f668aa7efcf752fe8db3d1253eecb6c58f78cd1ed74f5c098877cd814cc50fd22ddd5299495f944aa7ca76f475d0be9459f47aaf
SSDEEP 96:EUA7UDT1UtUE/ieUp7UPUCxUmU8UKaUiUBUBKUzUvBU8UdUyUcPU8JmUp6UeUPUr:EUGUH1UtUeUp7UPU8UmU8UKaUiUBUBKR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 0045c2f37cb40969d612be99b7c87575523c7c95a60fc27581b18c8b1b56cdf1
MD5 48036fd4cc9c7d3885a23c51557d6073
SHA1 d18b0dc2f690af07d7f167219d227c6169878a05
SHA512 d75034b52b4d6a2a7b07857119e76154c92064cc9f188a10f844b22f3e42669807dc667d0175ac8cb1e63349f3710cf25be7cc784a64b315c0241f87f564f110
SSDEEP 192:7YqcBzo6Z0x/VZ8PRplVDlL+i9pHS+WN98jghAuLqAKYgYfFL2HehVrxbpQyIsnA:7Yqmzo6K6XdTc3BGY92oVd9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8f732d0f78825b9f3de38efba6bea28d2d80c2c686b34b1073bbe253de2edd8a
MD5 e17627f2344003cd6824b2cbf34079f6
SHA1 9a77a0b40428edc04c4dff21e83abce9f7d00ed3
SHA512 56d3168203731ba25bcfe0d06db388833b597b1855adda6d1b1c564916ba09411ab811661085d6440b01fa5dde50ee93f520652f2031619ff208f9ca5cc622fd
SSDEEP 192:7YqcBzo6Z0x/hZ8PRpeHVDl9v+i9pHS+WN9tBTghAuLqAKYgYfFL2HehVrxbpQyi:7Yqmzo6KeXmTc4BGY92oVd9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 99e9814d816592c5c478685d7797f4a06a3d38de55f20b16e035cefa61f6dc2e
MD5 8483832d967e01145673517aa5a048e9
SHA1 453ea91456a1356e419530221da6e235ba2686d2
SHA512 9c610950ca44e02884f1fe143f310df7a4901f3dbdf0fbe117534f84c8c25ed893c2fa250161722ae3d0ff60292f47140fb7377a792d5c13b103ad275dfdd338
SSDEEP 192:jYArcBz26Z0x/dZ8PRplZPJ9pHS+WNEB5R40UoTfeJFL2HehVrfbpQyIsnA/g4:jYArmz26KCXZTcgMse/2oVj9Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 baf6d0d9aa6178cc9fd7f05b983f8a8cc90e80bc1bc9e59e910a005307b06e89
MD5 8722b72b34144e44bf7f9d24af2c96ec
SHA1 0f7383de5b23ad02c0c0613e1618d5379471bd6c
SHA512 f8ba5a16d7d8d54f528d682c62853b079eb79b6cbb4e60b22cb78f5021a35e4464913fb293c5172d4c21af69b7552b93fac1733a8248110d706f643f2f3de2c2
SSDEEP 192:jYqcBzo6Z0x/WZ8PRplZPi9pHS+WNOMB5R40UoYgYoFL2HehVrfbpQyIsnA/g2:jYqmzo6KPXyTc3MQY+2oVb9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 b5e37fbc3c32722e812343be86a971f2430d1c0140fd52b81ce7ddcd9b7c09f4
MD5 c6296eea2ea15eb0f1823d0bd9f84d1f
SHA1 61ec75aecbfa8b4bce33e2f888aa3640f2112b4b
SHA512 fa00a4ae2667df071bfebfdb6c96712c8f37cb1c384b49f634898d07985168de82dc89680be4e9920afc9dfd233a1ca36b5764465d594d3a89fc74da79067ba6
SSDEEP 192:aYAX26Z0x/OZ8PRpWP9pHS+WNAkllz+y+eFL2HehVrfbpQyIsnA/g4:aYAX26KnXeTcFD+s2oVj9Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 e2fd49d4c3a8964ef6bfe41ff68c167058e5fc0a582b9dcd659fe4e3498e25c5
MD5 cd771d4bf589bda38740af4701524ffb
SHA1 2ffdf4c542fa2441f6d68e388232ab872ce95742
SHA512 8c61baab25a884b229d769653c597bb08444caa7616eba3e15329ea8a146f206adf686a16754aa9de1d8126f353eaf3ce3c06d0f330c15a295f061cf7a36312c
SSDEEP 192:jYArcBzo6Z0x/WZ8PRplZPf9pHS+WNOMB5R40UoTfecFL2HehVrfbpQyIsnA/g2:jYArmzo6KPXvTc3MseS2oVb9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f6cf9ac7cd52eed6f3e0cf0d85eac7db68be818424c3f769ee061e17ad64e6b0
MD5 1e030dd35068674fb40499987a202d0b
SHA1 3c90e0f9b55a64d69bd4d5862f556ddb77e9acbb
SHA512 4fde9cb6c7847f887766571cfb8832249fd6ba778551382f379287a7b4f415600c5960e6d7576cf59fc20ee242c1810c472db897ffb13619812620fbdba80859
SSDEEP 192:YQYqcBzo6Z0x/nZ8PRplbI+i9pHS+WNK7BctEzsIYgYmFL2HehVrxbpQyIsnA/g2:YQYqmzo6KEXQTcTpwYk2oVd9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a6c6048e179baa9df0c4ff0ff24ff99aa9e89d0db04a3d626e3363262f85bc99
MD5 74141ce8679b4b0c047b43090dcd3f97
SHA1 f44eb5e28da5635890644531f8b402eb40237104
SHA512 05e57d06e74412dae8378814eebe6debefcb5b79913b67ea9998dfb04822da6263b6249f1f2d8a2aa0eccfc09d7e3d5c609fe9257d3e03cfe3ea7bc09011238a
SSDEEP 192:RYqcBzo6Z0x/sZ8PRplWFlL+i9pHS+WNPjghEVrB0NKYgYFFL2HehVrxbpQyIsnA:RYqmzo6KNXwTcdr6GYL2oVd9Z2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 104a94f4f2986ffb0e07fcdd9dbdedee0e456e4455e636264709b5d6acb030a0
MD5 16cd47953f582e9a4bc4ad066083dd0a
SHA1 0c82a6317ee2098306f04594b46c4c80c5178780
SHA512 8770aa7de742013d0e50046fb3535ce93949a93ab3c5904d7eb149394367a26244007af6d4e1964920fa8e5267ceb81ede241eb55976681020cdaefc8f45f158
SSDEEP 384:3vBU7pLuLco9jCXlePkXqKf/pUZNCgVLH2Hf13irUrAHG5vli+V:3JU7pLuLhVQlePkXqKf/pUZNCgVLH2HX
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 1a3457ed102d21342d35c9382d5434eb22f4dbeddaf97e611cbc7c2b65a349c7
MD5 1ba469a57d42f28046dbc938e366f0f0
SHA1 c8fa078e701469e09921304afecf5821846a330c
SHA512 9011a9ed1f4a2938d115195559f22b99165a38b866489fedbb78567f0baa775f8f985f488faba1ba59fb22474db49247dd664aea02798b9921f5a018745d6161
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f9cb86516a89e4f07a9ee5ec973f8b644bde9bb3212c7bb862dc07984d2e4ec5
MD5 0aa586810e45904366349ca9f5dca6cf
SHA1 c7342337ca9678d192837b0a7a04a8d540ae2676
SHA512 ff9876e9e09cf5df5ebc9e6fc4a9f7bd6e2a8f1792a852cb886235916ed054dde2fbda331ea8420713ce69d07394c7fe576a9e34723ff5587fd21e1f82f96c2c
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe578b87.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578b87.TMP
Size 48B
SHA256 2f2aa92f3bc68fe9473f4857dc3e3f5a58d19143ce72a5993804a3382bd1fc96
MD5 c0191d4fc2c9ab742bba78732cde0706
SHA1 dcd14012877314ecce9cd38d341aac31d9b910ac
SHA512 e472dc39bbd3cab3ded5c3fed9ed470e2e9a56a644a46a1a6d7c67cb7dea3be7bd51fad21e932da131d9c6aa01ce6ab18db1c5996f535fd88827ed64e6997730
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 a8035c5a1b5fac9fa64ab5e7da26a7aec78c265b881cd4f1ebdccd1353840740
MD5 a7d02920d160c5b56f477fcad5259bb7
SHA1 eb8178295f29aea2daf9d4123fc21b41d11d9a7a
SHA512 7a7b92c169c00cb054176fcb99b62be26b01068d920c9bd19374cef1bb502dfafbedbe9217e2b5896046f4481c5bb109237c66492cf1e3a3121fd00995081837
SSDEEP 3072:hyAzXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:hPzWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 cf6194c6530af7efe48fbf8ac9e35fb2d5eb1ca6977b6bbb130a6b8bf7293b11
MD5 2764be50c94f5e0d50ca57fd005589fc
SHA1 e032d49ff56ab2e96ff581121152aea13411b177
SHA512 14bf2847b78964e0525082899a521c71c9023da8ab9d6a42ac8dee1c0d6bdd913d792fcc551e4888311645358e66b957cdb2688561806fc86b30e698d18206cb
SSDEEP 3072:ShAzXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:SazWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 d78eb8818c5aeb50ca75cea80d92d500e7ba3b00dd81379048966fa1eccad52d
MD5 bbfe062221248062c2d5df318a2d8d6a
SHA1 6111f2e925356af7066669640b1aa55a4c0bb487
SHA512 50a479e2e25c069691493503fb291c384f01adbc783108eb893c52249d86f608dfdd842fc4c9a35b161030faa9601cf7783c8a3de5c146b8cd86b4635984902e
SSDEEP 3072:dZRXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:dbWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 d88b0945f15f61ec523cddca1f4a478fbd4a3b6473611f142750843b7b1729b2
MD5 0787562eb0c8a36deb0311be040e8aef
SHA1 173165025ffd28e687f11cc4799c9e69440b3d89
SHA512 994e0bab01da68e9e3b73961f7468630303cc59417e7e90a8ab45a4e1de58e1f6d0958b9aa99a742ceff1c85ba1eef7ceec1b24a062851fa5bd94b8b798d3708
SSDEEP 3072:ED7IXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:EIWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 c1d3c203454db7ef2eb96380f94a22eb6bc999eb49d82b88004db183f93d3410
MD5 5a8496d82cb94e4b10974bd2ce42ea0e
SHA1 6d24d865b4921af720a77717e43d6d884090aae8
SHA512 2e49eddaaba8374a10fb839d356d59f1386759d7325233cfe66771e41841c8b06d33040259a0750fe51822d13d92ea21402c4f02d2707602c44c264904e2cee9
SSDEEP 3072:hD7IXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:hIWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 2720542f14dee5c7be9427a991bd09259c2657c05cdaccda60cfa28dca9be6b0
MD5 bd0edef6841d95cf2b8286ad9ced96dc
SHA1 d429316efd181d503e3a79094eb61d0d82524cfc
SHA512 5fd596981dd33210af7a936cfb00bb988eef96164ee688fff26f89735742ef13dd888cbea10fe20ce1678a3f034eb81895c06b550acf977b3898144fba87c7dd
SSDEEP 3072:hlAzXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:hezWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 55f9d8b59c41210a426ac5b006c12b2c0f340c5810bb716baa06caf4b5637c25
MD5 a1ee6435a7cb4228093cb2b71e523f15
SHA1 340e500a9fbc66c259a869d9643b342c579bd923
SHA512 2e52921e0f7c9281c15c190cd2b3bf257576430566538efef4ab1c3705169312235fe6a85fa9af44f26371302676cef96ae161f11edef536f8bd8eaf9805d59c
SSDEEP 3072:Et7IXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:E6WMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 8d1704fabf253ce15bdc9c763cd5c357af73ea71d42f6535a6d49bb8428ab7a7
MD5 b7a116fe5ce6d4140a81c3ecb42602a0
SHA1 f3116ded110cd33002315b8c1b08b9c53181b50c
SHA512 31e15e62fdda1b7bbd333c796639e62f740a7a1553afe234823b8eab2a15009c159a1d319fbe6ed1f33243d3110912b7ec248b75b8eac662983c12b045f3ff99
SSDEEP 3072:hnAzXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:hAzWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 118KB
SHA256 3b5bf015fca9680804555dfe2be2866e7e9443a80db9961bceaae214d696286d
MD5 333b63bee1ab6d0166b5b82a55c4b8ed
SHA1 58e1ae412c1a2ca99e3a0f75c25456da066c5d1d
SHA512 0a777d6c9e00fb3f3bcbec9af02ad9a9d44b452186493259c1c20fcd6a06240d7c6bd97d8ee14bca142f1b700579a8d686f398876379cd57043628443bc9b5e3
SSDEEP 3072:hhAzXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cT1:hazWMExki2KL64sbWRtHqldg+G/M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nst28A3.tmp\LangDLL.dll
Size 7KB
SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
MD5 48125e63f130d69025cd2bbf9f3b0c4b
SHA1 e3923a75ed00cc53e2f0b3c1843598c7c1ede79f
SHA512 5b411fc88035eafee2eed3c4e1b8c14fdb09ed09ca275ec1492d7a72dcf9cf55719dc34e63c00ca64162a455339658efc958dd2abb6dfe8a363f2f24ff3bd5be
SSDEEP 96:BLIwtgI+Wdk6guTxZlx3ojaVgmR6wP3LtrlKVNtEc+InoAhrEoUK3EMbqKh:J89uTvlx4jhaX3Lt/ch4oZ3x
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst28A3.tmp\System.dll
Size 23KB
SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
MD5 8213548feab7394279d2712fc12126f5
SHA1 1ada5c813c36c66789b256da1ccacd9b85a97b4f
SHA512 3b5f96cca356bbac7a87bd2695e1b95b1c8fb6c3f059e8a9ac11724708c8aaad4f7e3e404a9be1c7354b03414b18123916c2b4772ceb033a91a8c48ee724e2a8
SSDEEP 384:ecybqzYqKbo39DihgonO/U1j/HCD3Zn/MUcD9RSSvUW6OEY3yW:lybqzfko39D6gUOMhKD3ZnkjRSSJ6O
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nst28A3.tmp\nsDialogs.dll
Size 13KB
SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
MD5 ff6b5961a43ba8c36434c9e707d4e6a8
SHA1 f73efb0ad4f4e9f5c716df5168f4168c2cb01ad9
SHA512 fc1da79bd1725e240f0eb259e2ae7cdd976e33f8c9b64083c9420d9a64aa2bde9251294d8cfeb70e5b93d73517c26594c04c8ebba80d9529235b02d52b0a72b3
SSDEEP 192:hVoR5bH/o9gAXCI6KW0fnFdFlCaYQZUhU+Cg8++9KdYI:hVQZ/omAh6uvLFlZX++9Kd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 21ed3c3e90419665c9c3ef9cf925c8d229e98677cb52fc55a6da926f1a7cedeb
MD5 b4bd80767f81f61039d7895a8615a478
SHA1 187acf34b129a1780737ce0fe1542ad9a8665f01
SHA512 a46d7484d96d810a4754c79510b2037b25a2710ee8e4f5ec8f404cae64e70e9d7540e92d3231160d771390a6498fd7ec9256e7dc79b2dc2f78f4604657757e8a
SSDEEP 96:fQvlZOQQvlsNXFf1NS/7AQvl9fQvl62/lggh:qlkLls107bl9qlJlr
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 9KB
SHA256 d49c2287f187b290a4e85a8010596b2c2b940566863784b62c076a2e7e4afdd9
MD5 032cce86d604b7500df4607102759381
SHA1 68e6c64946a09ddcd761752580823fe54adbbbef
SHA512 e496dba501aacdc6db168a514e1466b272d13032163f028bd3b67e5ed4eb7bf208aa4b1e741e1e23a242b09e4c0cf5cd66c399ed7efd6dbbf4beede3908e7501
SSDEEP 96:jHQvlno/FSoKHQvlZOQHQvlsNXFf1NS/7/HQvl6KH/lggh:jiloxKilkQils107/ilNflr
MD5 SHA1 SHA512 SSDEEP

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 8KB
SHA256 e8fe6d90d7a03fc62ae68febcdbda0d5619314768e26082b88c3a0bb599da251
MD5 4676f8a8f71cfb20bf15cfeb9760c4e2
SHA1 936189c1d6b424d88e8da9177742e7f17a71288e
SHA512 fec6a020a70117712b2a63b7324a7d71a729e3f4c9dbd769854a34653edc8fe396b6c572df2c88463373fa2c95fcc390edd5f424b5514538814faa59dc6702dd
SSDEEP 96:4QplsNXFf1NS/7zQvl9/Qvl94Qvl6l/lggh:dls107Gl9Kl9jlslr
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 1KB
SHA256 51c0f222873364c4e443773fc893151a046a0325f05c69255425f60cc7bacbef
MD5 fe4911fbeb5719647dc7a32f8b4b07de
SHA1 ff79049a93546fe5bca3da4b14bf0d6c896f91b0
SHA512 a858bbb170c094666fa87430492bd51395ecae6c28f63679d833c7c4fcebfa649df0878c484baba7bb23fc76d4dc5cf1bd6e02501a5538fcf8d04f4cfb742e40
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
MD5 SHA1 SHA512

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 983B
SHA256 d39ff1b1ff89d051432ee118dffee1caababbcac473f073fe2fe99d4509afb7f
MD5 a051fea1e480c65e789f4c9a45bc92a3
SHA1 423a2782ceb15b274a8115e7f0e61647fa56f36d
SHA512 efa49029d17dad63c2cb7ee6268190ec933d6205f0fd852c3f615bb562ae624e99764d324b650434c885dfc599d6c8872b197563354b6ad29ae0116f29e57cb7
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 7a137f85eab14db0c46febe2aec0978b5078a10cb67fbabd2107a738f26a97d0
MD5 3acee29fff628e85e3f1e205e1316c37
SHA1 892576b694ba0993d17e0994fe87d12f7d9ba938
SHA512 a198b13840dd23a3a182846198418f42262580bb81a5dd747fdfdea1291d2e9f718868c7a7384fa5911929e4ba2453ca067a5ab28d5e7230c3d8c565b50e2b7c
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 db5ec94ceb712653d5f95c9cf153f4d1a0d26e9d8aeda4e283546db151bf9613
MD5 2a1c957b84655e9d1c7bdee7eeb4d0fb
SHA1 2bd86afe5baa600f7011594b4c822133de358ec5
SHA512 0c971c183130844f23dfd945c3cde33f5068ed21f53096b7e267cf62ea9cced2620a88f5cf8cf4c82e897fad873ec40f67f773766d2f28f0f8f4aaf9490e33e6
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 dcfeeaee594be5e032f90e0b0344d91b40036b1043ed848acb4339380518e488
MD5 07d441ad671d471b63be15e561a49898
SHA1 d3240b280bf7836d497ddc40e3d96c4cc114894d
SHA512 cb7be71145a641cbe64ed78125ae54bdb21bbf6a79edc292dc039c3c2b3f8a4d1d3691a7747a60344956cdde03e9b1ab1b69a9b65cced946a3dee30d200b0cfd
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 2ad2fa26bbbc035c9361e74784e38b30b9784ff70ea54b1d38840bea437b609d
MD5 efb9bad4a7d2963f98f9d4257610fd22
SHA1 030b5644bb82d8aac61bf5bd757ff4614f8719a4
SHA512 0640f6449516b846f32ed3d67431d34ed7c27cf705ed5f356c7d6071a74ad1865104e6377b7d9baad50cb8ea2dd7d71d76a81bf61ca6c413615722c677d74a38
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 983B
SHA256 66ef5cb6b0a6992a269d17bc59c1c16c98cf04b39d082b17dea6f8380b93085a
MD5 d1d9191a2c7b9412a461ad67d914589b
SHA1 8c97deb383556557af18e5824be09ff127ff6db3
SHA512 835586b867d3b70f179b3e1f24e478ad87949fb2a1f3c4a76bf65279be80fb1b57f6df8b3f74f8b3d70a64df50c968adb688d30b75abe490e0dab51ba3218568
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 140B
SHA256 48cd83f0a9f8a14fd4e18d1ca46569e41bd49dcf7b4b621cea208dfba5615a89
MD5 54e9350a1804d1fa5d9d3fd562329351
SHA1 aaeac90092a3f5a827406999a27635d5f78662f0
SHA512 4570c93f7e256a8043834a5fa24f593ffcf85af83e53c7af674142d5697956bd617ffff665d6c57d117c8e54f3e66fce44a404eb33c9c0a23caee61194d07825
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 983B
SHA256 1cc4d7ea17725dfe1d7bf26d4057a96eb37867fb52376b5571930e2648d83834
MD5 2e907c87bd605ac78a74d9aff54303d2
SHA1 94774d54c9e5f271572b4d42926da1140a594fa0
SHA512 3be5ce41fb77b4e8eb91b9270be3919aa5de786c3fc017c1666cc6d703d0fa948ee8e8899f25af40a23b8558e674a9b01f6c3d548d4617ccbd8e9e7c988e9e1d
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 983B
SHA256 53a4389224e820ae56801c630ffc1d9e974abbac8a1010a92ab3d47768d32e9d
MD5 c355ec3b0e3ca16154ed7c30612d382c
SHA1 263290ecd69d0016b7bbec6a906119cc5c2408dc
SHA512 b5fefd0ca3470f0e82e52114781f75f1b8c12005ef7e786710e19233672fe5c2795c641b06d7da53c3b9a4dae76b3299f522007541452e14f8dc0cfffcaaee3b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 983B
SHA256 ce8342081fb566206c9c4a17929aa7c04db9be42eb82ae0a80de2c5b054f55fd
MD5 9424ce9c0d27e4719cc5512ea7702111
SHA1 b358e018d51aa47f2a2e2665ad266d1d14546d46
SHA512 a127311f703c3fcef2b55b6392eafc119292fa688bf31076f6dadb9bce017b957cc52492474976522e105e2c484784afaae2639d01ab4125db3d4e6634a066e4
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 983B
SHA256 aedf1437214798ea2684ae007e1cadbecb204007562c33de290f0b0e5da0fdfe
MD5 638f1c2fa65eb2a3d881984de47957e4
SHA1 2ada63eecf5523c8ac499a305fc1d99d0de3871c
SHA512 0ed1052ae07e5c673d79d3ba198874f886011e0c6b0665beaba9d805eeaf2abcedee7db4fd4bc69e5292e84dba84a518204a0f16fcaef42c9ff3bd4e967ce48b
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 e4e73c340d301c68d80d5a64625fc1a11dda62bddcf2608231cef5e224f575a1
MD5 b2b545c6231d98b5fd205c53b4f3bed5
SHA1 628b5651a32a5c032fbec025fce6a34cc063ba6f
SHA512 ce675d8cf7d8269d3e043c10f396b2af77ff2f305260099fa946f3f914838c9076532dcf2367cdd045d20c50aa750e0d094571249acd88088d58e9304569a5c4
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 2faf60c4b428689ecfbdb66d087375d1aa1defafd8cb5ab258fe8aa39c9c903b
MD5 f5ce1df6bca39827c9d0db9b1f1e2bed
SHA1 ae4661b01661bc08de47517e28e9ac831bbaf522
SHA512 fc9bbc56d9c37bbdfb62923d9460563099c991eb139a87bc811bac5460a1f54b5c38a0e79098ccc096b8ac56dd924ff1c062fc2c164e956ee509f8a7453ee3f3
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 4beaa3f1db137004fee352ef674497c404904c3c3ba04f2b187ad953bb23951c
MD5 f57a08e4c4fd0e5e7b516ba011f19386
SHA1 8773e3a7ebbfa40c51de6782750c535ca7977124
SHA512 6f1755b75cce95b2cefc8ce96f53461c95094811679c4b4d39e62f63b4f8b6dac9cb062f79b5e0180d70882c59033e9df863ccf884e32a7e20ee6a5f67546074
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 83572aacc567a19a4776a667a600011730bbefeea8108368a65f45753a855bfa
MD5 939a29de6bd4efd3d6a2b1556153d56a
SHA1 20520d52abecc8737b6f53e3c5df9c80ad1c724c
SHA512 ec171e0023df2aa15f5a9ed159c8ab729cfcd4df1ddcf7fe93eadde44215bb93fc6051b7a9f6797183055c0694dda260cbe3b9e431988632241d73b3cd6b7b92
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
Size 243B
SHA256 c1a84bde1034f149f1d35e1b343946f468753eac29c4337c9ad809f4d9204598
MD5 b85db86f59f3ad853970b839ee4c44a0
SHA1 168a64299f9b90bdc8365e07890f345b286bb623
SHA512 749978bc16bf55cf0efee65d9e8749bfd38f188ee9683d18aed2722e4e171257baddce333f083799e2828053c00e64193b5712dbe916750aa3b6a4e9cc7fba70
MD5 SHA1 SHA512

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extension-store-menus\data.safe.tmp
Size 247B
SHA256 8c2f861fcc229ff96a4e411ce4d4cfd12031f38c1421715d2464d20ba81e9234
MD5 26d2cfdfb85947febc966ed90a693632
SHA1 cec5b1bb605c6f1a2ac1f6c4ac6a8f1606ab857b
SHA512 05d848647b848dfda66bbf1911738ca795989054a5ca71626673a217a5ff576629a5864023f16bf1d0a064dcaaaceb9421c3c88941237122bbe084d513a02576
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 17KB
SHA256 9e355e3ed12c624d2e2b04a6c798f3ab9f6791eaef7ef0e1631dcd04b93fcb0b
MD5 005b64a2ee84e04f3a8bba4d9d019718
SHA1 880f8f6616980f53d60970b6ef6c6398541c141c
SHA512 e0a3a9f68101ee97d9a483edb79a19098292ec851a030766de29680c69990364bf59f55e71d210fc4204ad0e4fddec9b6c7c31d5582fd2ad3843f35a7d11f9ec
SSDEEP 384:0bhm/RqON1ln8TOu/WPH2+j/7hSwL4HcL4HPL4HbL4HC:0dcF8W/2g4W4z4n4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 a73bc4d583c5f878a473db237cb55a4c665b81dda347135d47cba364b4e7a071
MD5 a16b93b1e9d65ab2d25d34c57d5af47f
SHA1 5520389f1f9ab3d0332d8b27bac3536f7380eb75
SHA512 d2663bec149f3b2c1fe6e4ea34b263c20ab886100f2fb146b9a8ab9b4508f60eb2e5924b10ac527d7b5be314897e4cae1e93f862f4c8dde21464cd6a5044ee09
SSDEEP 96:xHRopkOTnqGqwYtbzvzuzRzifbtPpn7Hi2+NUjYVCBw8ppua:3RwYtXz7HsVCBw8pJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 50522eb0b92ccc72c319172250a71a16ee20b63fc13e4e1e20371a16f124778d
MD5 e79be9aaa5c62d5890b6cce0c6dfbf26
SHA1 36c27f886f10135340c84721821abaddfd756a74
SHA512 bbd77a2c7fa5b5d7856d5e6b6ed8ae25b7183b0481af1e3857aa733edf8221bc6547fb829a1909fd3db4b7f02ebec7e96b74d37862ffc8ce60c3ccb60ac51a22
SSDEEP 96:xHRopkOTnqGqwY7NzvzuzRzifQtPpnWHi2+NUjY/YuaiMABw8778Wuv:3RwY7uzWHs/YuaJABw87ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 aee1e91f71ec17dc65e2d1d6a26160a4c4146fc659c0ace9ba894563d5988945
MD5 0a4bd8c567e76b3b1e0b191059dc1be9
SHA1 65254a0a6f43c6fae8552fe5484bf56912b2af4f
SHA512 d60e3a32a30998f7a87b3ab887d8c26e8b75cc9afce513caae4c881a5b5304ce97e95748dec13dc2ebaf70712111726b4307133c2f34409cc09822c194b5579a
SSDEEP 96:xHRopkOTnqGqwY7NzvzuzRzifbtPpn7Hi2+NUjY/YuaiMABw8778Wua:3RwY7dz7Hs/YuaJABw87oQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 9dcd470dc976c22b88602310746a208a670668ce05e2087fc84cd84d6c96418d
MD5 ef5e51ebfb19c7de592b87a93b903a0d
SHA1 08855260ac237f71ddee5286962a18d741bec754
SHA512 4ee4126429d09f7ea945554c6f290e93ccecdcd55498edc5ad3e81bfdcdda8526255b50e94bda7fe23eaf0cff8a605402a7359d17b57b26020c6fb30caa7997b
SSDEEP 96:xHRopkOTnqGqwY7czvzuzRzifAtPpnWHi2+NUjY/YuaiMABw8l78Wuv:3RwY7zzWHs/YuaJABw8lol
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 6KB
SHA256 8d40d3331fb10c4bc11954263cc3bb5a1998be7424f572efac54770efd81cc55
MD5 3ea8e4266cd2f6d5e06e6e0979adde9d
SHA1 0239fd0fa96936df81ddc958b6f54972dde13aca
SHA512 6cf4720ec233438b91515b518007fe3d57d988c36eb9e46b537ce212eefba958e599d16073b840f2818cfa224e9a4d06406fc54d820130ebdc3f9cdb0ca2058f
SSDEEP 96:xHRopkOTnqGqwY7NzvzuzRzifAtPpnWHi2+NUjY/YuaiMABw8l78Wuv:3RwY7SzWHs/YuaJABw8lol
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 792B
SHA256 c846eaa0dab8f1effeb96c3516679448452bbe36df6b0579df631670d092b3a8
MD5 51a2d42b3e25ce9060b8100764d3bea2
SHA1 a3ecf95f15ebda2c014fb0299eb8616674d8a6a1
SHA512 2e71e7cf70d26688868d0bc7534f1722004a0b3b0b39bf7dd3fc61292d5afe621a7be2effecc3fe993ea3b83d9bba068a643f3ca7aee1f23b1f9c0dcb3b8b32e
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 3KB
SHA256 b815a2bb60c4ca11274bf4ae55399d9faee91afa39ac4e606277e86142d1edd3
MD5 487a5b7b5620a6341a9a1f8464f794b1
SHA1 e98e80c6e2c56d4c0e232b6d911e0a2fa43bcf9c
SHA512 7dc712a20f32473cefd28ef3b9177f2e99fcd3fb201accfac9b2dd6a6b9e88795183aa902270e0a687334be3d5cb360a9c8871a1b13bf808ad978b6a0dcb58b5
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 1adb43c83474acb53e973dbdac309666bcdb0d4c4d472e5bca8905e018c31dc1
MD5 b17e5e82f4e5514db3ab2c24e5436408
SHA1 9ca6dfd00050e719c5f3057d2a33597bbd932c59
SHA512 e1d2a315cf815260461cb25358c736f57cc3a177c0938a0b6d1e9d260d3a35c347125d6001eb98b44c5e80a78e3c67885ddf3b39784dce53f2589635d4cfb68a
SSDEEP 96:xHRopkOTnqGqwY7bzvzuzRzifbtPpn7Hi2+NUjYVCBw8lpua:3RwY7Xz7HsVCBw8lJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 5KB
SHA256 65a45497d2f0c8698fb62b3c685315e4d7a5066577f5d78c4dc8937da223db3c
MD5 1ac0ef8e2f5eb1dcda915878639357f4
SHA1 035f97b8a9a773dae8cfc86e6b4936c71b7bc750
SHA512 188ae55207f025c572d3fd106851adf8fd7d6910eaa3d07cf09b4b20ca6f0dbe2535904aa285580768605de8d03458d047821446ddb05de01ac792b9a3a5c8ce
SSDEEP 96:xHBTnqGqwYtbzvzuzRzifbtPpn7Hi2+NUjYVCBw8pi:SRwYtXz7HsVCBw8pi
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
Size 146B
SHA256 7343d5a46e2fca762305a4f85c45484a49c1607ede8e8c4bd12bedd2327edb8d
MD5 65690c43c42921410ec8043e34f09079
SHA1 362add4dbd0c978ae222a354a4e8d35563da14b4
SHA512 c0208d51cf1586e75f22764b82c48ecbb42c1ff54aa412a85af13d686e0119b4e49e98450d25c70e3792d3b9c2cda0c5ab0c6931ebaf548693bb970a35ae62b9
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
Size 122B
SHA256 72d74b596f7fc079d15431b51ce565a6465a40f5897682a94a3f1dd19b07959a
MD5 99601438ae1349b653fcd00278943f90
SHA1 8958d05e9362f6f0f3b616f7bfd0aeb5d37967c9
SHA512 ffa863d5d6af4a48aadc5c92df4781d3aacbf5d91b43b5e68569952ffec513ff95655b3e54c2161fe27d2274dd4778bad517c7a3972f206381ef292808628c55
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
Size 241B
SHA256 dd8349e2789db1125b477971c5d445b6afb2f6ea3b57de65080631040900fe8c
MD5 48fcad918c62db97e9af1dba1d131473
SHA1 d89381594d3241b0e645033f67572a5d8c166764
SHA512 2278d074aab519859188b047c77fe7b4db718e0af237b63e06a1b095d7a1eb4e07d6ea59cab5d7b1325aae0047fadea36eae12a80bfefe112aab85fc18aa1ca3
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
Size 181B
SHA256 16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524
MD5 2d87ba02e79c11351c1d478b06ca9b29
SHA1 4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1
SHA512 be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

3647222921wleabcEoxlt-eengsairo.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\default\moz-extension+++01d90ea9-40ca-4d50-88af-97b1d7857b27^userContextId=4294967295\idb\3647222921wleabcEoxlt-eengsairo.sqlite
Size 48KB
SHA256 0a18452d229fdb2230e26a654f4b69e4865124559c0ce085c679a185093dc6bd
MD5 d468eebabb270f6c15d4f0c96a598c6f
SHA1 8dd4e145fd2715c810b9b2adb18c954a1202d986
SHA512 1399aa413f558e2ee2deee4bce6806b9a48d42b4fbdb5c52b0dfd0e005266711d5d772bb4f0171a5bbf08ec3bd09c17249813b8f955c12865e766569d0e76074
SSDEEP 96:516S6CKnqlizbxV+2xVeU7X2B0jGOjMtjMIdjnqR1DeOSSiEVJ8kkUFG9feZ:516S6CdFAWcGwgTxSUbEVJ84FG96
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 168KB
SHA256 091a77092da27426f9cfd819819bf71f58435680aa750beb2b9aa21c098de060
MD5 d4213ff99cf558c3fd72d9209cbbbf27
SHA1 11fe1a2cfd78910a0c95714860c8a7e90cc94f3f
SHA512 7c6c17b5d58a2f88a647feb6c5751b4d150bc14903adf157640760dd7f401fa132a7fa97ccc27adddd2e64d9ab7fcdd56a9fdfac91e9fe74cc225f2633c6ab05
SSDEEP 768:t6S6CrAWiNcvo8gTDC2wLECaPfovT7pw+vmQBIfBRA0TTRAolp0gP5aWzfaKiQ3y:t6S6QNgTD2XpwbfvACT1lWgx5zyKiR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 248KB
SHA256 ac04ddd698f71586bde2ea86325ef3067a2f556aa0f5e5193156b4726fb23990
MD5 7215f74e302541208de3521aab78c044
SHA1 cd46aaf5ce9c21120dd62a04bc6ce05ebb743173
SHA512 907fd232bd59dcd12bfabd79ac5fad9af391de3d2e2387b5778ec06dbf008c9a2e5e71e31907ea4812ddda5a2383f1de8e9f81dad219b3e1e07d720e73271cb2
SSDEEP 6144:ifI+6X3y3MpO/SXRQ6uaF/m+eH06qcHq:oI+6vO/SXRr/mSj
MD5 SHA1 SHA512 SSDEEP

Submit Download

profiles.ini

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
Size 103B
SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
MD5 5b0cb2afa381416690d2b48a5534fe41
SHA1 5c7d290a828ca789ea3cf496e563324133d95e06
SHA512 0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus
Size 3.2MB
SHA256 c5c133e5575dc07c9c8e672d7718fc8c34cbf00329c1d6f649ed1fc314d7b51c
MD5 31f3dd11e16cb09fb8902f82c3c46fd4
SHA1 3b7baa3d56377e64b1541f978ba7ab1f23af9491
SHA512 024e5c1b6848938d044d943e69be9bef94115c65ff954873425889845882e541daddba9b33956d8a685e90b25fde52bef4f1b80bb2ace89e0526c0d07df28b5f
SSDEEP 12288:oTLI0g0vgpxRHtmhI2k2fELJrDKKQRaKEIq6SV1TLoe5tABTB3LySU1oh:iHgOgTRHthp28LJaH2Lwe5y93mT1e
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
Size 10.9MB
SHA256 b91c23647fbef6a13ee24a9315fcd7d68d1b1c9f77ad05f41809a689fe612ab8
MD5 eee591905355ce3e27e70bbde1fcb5ff
SHA1 6a98a70f834287f2825d0a95b3c741e299f96625
SHA512 33118cc97de8646f8a7a663cf15243e6f14ecb5e0572e6d49e6558567ca8c66a9222bd02157d412d582d9c0cc297fd96f5aed10a672a18278c7423db4c1cd587
SSDEEP 24576:CUVoipVKdh+VC7/DiQ04sVm2NA0VqVrV6VjVEBF0eS/SLVCMNWi1LjIsqge0VjwU:8NWtUmAFn0e
MD5 SHA1 SHA512 SSDEEP

Submit Download

torrc.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc.tmp
Size 511B
SHA256 643450c19b590a7cd98ae0b2ad39dc99d721da737a9c64300e1e671e7e1b4fb3
MD5 ad2d90351718f4617d04bda0c7fb77ce
SHA1 9d1beb30e95f48a24748c41371de64c2ad117825
SHA512 8bd399ff10836bb93285a95321d0ce97198c8bedecb6f2f5b92cf0e72db6f5fe38838afc24e1f0e4b5d0eeedce017bcbd0b16a203f6ec623d2378fd91719ac12
MD5 SHA1 SHA512

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
Size 26.6MB
SHA256 89bd024a2b673dac1a89b2f46da5f76a059cd900dc0fe37ac90a7df997aaa901
MD5 ef184d7033a00e0c3c9695eeb8043fda
SHA1 594e7b08e5c0f0563d204905292ed2116926014a
SHA512 7db093871852f57e60c01ab50205495adc973e6cd4f6c3c1b9ec48de64277eb00df60e0658dcbc8cf5383fc41b8eac33a10bf489a8fb1aa13cd91d85f5f46935
SSDEEP 786432:+EMINVKastGEJoieLz+hGIy57x00/FzfdgqnkKEBe:5KasJJoiyW4XVaqkKEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

channel-prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
MD5 SHA1 SHA512

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
MD5 SHA1 SHA512

Submit Download

{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Size 975KB
SHA256 9496d2bc785f2b6dff36a3d6f60fa1a70d7b9a1895bc738c30387c94cd945168
MD5 7925ac63a0047fe4b67c6cd64bf4adf6
SHA1 90fb1a479e095d23067e41c4796aa5f02ff18645
SHA512 9ea233430361f221af0bfdc3116af79f2b8cf9cc2345ec7729e57b4a2ef62683b0baa865d28488600cf9b59e7f305990f7238beb605f13c49529219b53fecdc3
SSDEEP 24576:qNtg1g2CRE6OC3vFv6aFjoCATrVBs0Rzp2XChjX:qtgO2gEB0vB/Fj5OVjzp8ChjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.7MB
SHA256 f4d24d2cdb03a135c3f41e4c1997da107e144ff8b5c66c6e15dede698961f4c0
MD5 49f2a2f814f8704eb9a3fb63052bce96
SHA1 b54b5d50e9fa92f64da464f5c3c7646495bfafd7
SHA512 b8460df1280757ca5d3bf78d5d8482723422ff65d1a826800b3c9f63ee8717723367b6c623cde05b17ab8e6851d29ad09f8b5f5c94726dd461e020e43cd91c8f
SSDEEP 49152:4OHQf/SVcMbBZ45kHsdA/RmiynqetHHHHHxHHHHHqwE:4rfaKkHsdA2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

000_README.txt

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
Size 296B
SHA256 14014e6904c0a496afaf2a7ba6f63926d16d4e8695862d3af439954434765de1
MD5 b699245ef09504ebc6f7851bcd00524c
SHA1 7aa6fe2d8496f4d23f401d5867ebd174f6c1ff61
SHA512 d3a56cb9f0e9fa3fa4db87bf5e8eabf78cccc297ffbef3cd1f1969621c1bb50eda42ae8ccd40ffb06aa69fecad18c0ba8f800b501f1446b8aa454d2df06521ec
MD5 SHA1 SHA512

Submit Download

NotoNaskhArabic-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf
Size 239KB
SHA256 2d5d78e9cc27d7193926c7e460314c9da7dbec1268494dbf117adc53c171ac06
MD5 75a26f9ce250f3ba740481374081ff86
SHA1 7841512f9c97da85e037e03b27adeaac2024968d
SHA512 7922811ec908ef6a39bb9e33927275393df06bfe5da22b75d924efc0e13e399ba495b00fc245c5a8ee3885e2f1de212dc366aee387b15a87d8726f69cad2690c
SSDEEP 3072:nAxJbl0JUcv9nKuECSuaDJfc4BjoxsXlZ5LfnLBvJ6Byvn9S4Njb:SJmJUI9mfc4JoxOBTBvJ6cvn9vNv
MD5 SHA1 SHA512 SSDEEP

Submit Download

NotoSans-Regular.ttf

Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf
Size 596KB
SHA256 61b72eacd39533f0e5916cbb458abd7b3cf870667f63f3069dac2a75aa0317a2
MD5 5263051e028cb83196239d4a3cb188a3
SHA1 e33d657a2646a020fafed4ea6dd0c05033e1ee02
SHA512 902dd869779426736ad61419b0a877d0019a9201e08386cbd456c6dcf11ce2bc98819560797b2bec8960e70afaf38979ebc106ad745aceed7b079e618547ac58
SSDEEP 12288:diowbUE4QRjqxpyEoMJ0zwHXAUGTo0R5law+3yqhAyyZ1:wWEP+OEoMJ5XwQApZ1
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
Size 941KB
SHA256 aa8ab1e803e22e70ce0ba55a6f196a011d09cc55725634d9f545c18b7a4a8138
MD5 368eba78e706726a139cfc5d942a1dc6
SHA1 8f76efbb6d9dfd3f365124585de785c336f6ac09
SHA512 ae090147ac81ca7537c72765701e3637e8db6f1b81e82bd7ce7e1738747cc8e17c9f59c70999cc7d748477e32440ec2962e2b21ad76f585ec0880226b9386788
SSDEEP 24576:2K3KsVVtodQjbd69lfUUxvfkMq1wL/Z+h/:P3pLt/jbd69OMqeLw
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkcodecs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
Size 8.8MB
SHA256 2256d118c7a526453983c3d6a1b194dae034a1cdf2216185900d45c12d529f1e
MD5 ac02971843d8794097b4819988e7cee3
SHA1 19714d77c345de64038051b3a13169fc800e4a91
SHA512 347f951cd1c742e384ed99c5e087d0860d5cd47df160eb81124ec6f6af9a3f91379dcd921d107343448e702627f394956cc9e80bccb67c46f0c5226dd0507ef0
SSDEEP 98304:YmKF+yhM4x1q2v+pavxuBJ1afN+UL1KnbqDB9t9z5sp6ge7piXv:YJMylx1vvX6M8y79z5sp6p7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 343KB
SHA256 81d9c1f0acb9f6f061566031bd3da54517dde3d170f2774ca9e75f9885804d20
MD5 fdcfce51ad5f74f9af6efd2f1c1de3c0
SHA1 4a23f1c0ed6bf9be0ce02904b43c6d5808c4638f
SHA512 da3cbd3aa2f86fd2d5fc1a44a5800b34e98db982d285abf816bf2f40c8ac8aae5adf27f33fe5614459cadef23de7e80a1cdbb860ab93958b683877541e4ffa8c
SSDEEP 6144:pV6ebIKEZEDSEiqGnHYHHO+j5nBzv8dHlDmk2zH29h2gkb:H6e/EZEDSQGnCOGh
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 973KB
SHA256 2f785ad1c8b8b2f5d5536382e77a7f47119ff681e60cc226ca9fe0c85a7ee589
MD5 4fa0e639225d55e522938e9eea477e22
SHA1 f4cfccf3b9df8e1fc537453567620a6cb8cea2ca
SHA512 9301152c3f221851c7aab74d5faec77a07276ef266be9cd00de3b32e0df5b157560d233b33626ec71c36bb8343a10ebb3131c3ff55e1f5def06c1870dcab729e
SSDEEP 24576:Vewey5rYg/SqNLuBIMNGSoG5F8LR3zQFGPPPPPg:Ywey5rR/xLuBIMNH15F8LR3EFGPPPPP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.6MB
SHA256 48afa32f005a443b723e01a295a36373466fe90aa89ea0734bd3f1ee69d83933
MD5 bacdea06e0ecad44c782c5b2757d177f
SHA1 3d3e615fc060b7d4413c256764b48594b726eabc
SHA512 c13bc6ed62e26f3811d81b4c277605076b6e8e4609cd5cf37682770e1e69373eb25b8488c526f2e52d1537932d9b7f45498b111c26ab4977630535afecd2fc2a
SSDEEP 49152:/n0MSd04kWCk/DNAbR5XZ1zgG53wDJUQ56Sf3N0jPdPJc6NBndxfs+1IOXhhhhhY:/nIkkSrceUJXsPs+1JhhhhhhhhhhhhhV
MD5 SHA1 SHA512 SSDEEP

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
Size 19.5MB
SHA256 b15c317174833761ba8951e296ca6000c112c02f5b1443329e832e63159993db
MD5 6eb32151f8ac96bee1c7376b8c5f7c94
SHA1 417597b1f373e754b453bbc9a15bf50a3f1dbdc0
SHA512 343ac2f83760c703fff00f0e92f505f1263765a0ccd07b346528c95a52a1bf2d5f145fc5fc3447fbf2238ae1cb98e2806a1b5c897bfb6b1838cb591ad81de913
SSDEEP 393216:ZV16iWnOQMoaMn7/h8NgOQKU4fVfSD8kNyCPX5BzYwGQU4JmmMU:ZVoiWO+758NCftltX5BzY2HcU
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
Size 281KB
SHA256 93cc8a0ef8f836d97e4b716fe5186e6334d33ed5878acca63a42ef86469684e4
MD5 ddec178ed2f78bc451dd4b1c6421d697
SHA1 13dd08efb3ba45358a2f250e5a4c9eeacaed3d5d
SHA512 f8c2a56d09d7a3082ad994ab6f8940392133cc683b3104bc081cc33a7dde89d709c882e79ae975dfde860e3021529cbb77444acea84387250ccd880767b78ec8
SSDEEP 3072:Ywt47NWWxdpLRAoH6vtEqlKqJv0sIzUuMJnm5lJeep1cMjdW8+CNCOCTC8CyC9q+:YfNWMJ6TKEvw3p1cUd0Yz+xnfCF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
Size 829B
SHA256 c084e6b4407577a35f7bf9049683f3e1ebdfe5014aa0fa881d766fdb46559457
MD5 1936ec547e0e68f30ff92dcb41693dee
SHA1 cef479851afbb6e15780e414c4d2da9c76b3e78a
SHA512 06045eae2148031c2ff6bdb9c3eecdc92e3418fcfb89ddd9d4cc78d13c56ce3475261e4741677207abacb918ba1af70cdfc50a0a91912ac8d975f3c76c70a59c
MD5 SHA1 SHA512

Submit Download

tor-browser-windows-x86_64-portable-15.0.2.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.2.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/836-3723-0x000002DD19700000-0x000002DD19A78000-memory.dmp

Download

memory/836-3724-0x000002DD19A80000-0x000002DD19C1A000-memory.dmp

Download

memory/1716-3685-0x000002903E200000-0x000002903E578000-memory.dmp

Download

memory/1716-3686-0x000002903E580000-0x000002903E71A000-memory.dmp

Download

memory/2280-3680-0x00000212C6380000-0x00000212C651A000-memory.dmp

Download

memory/2280-3679-0x00000212C6000000-0x00000212C6378000-memory.dmp

Download

memory/2632-1456-0x000001D1B4100000-0x000001D1B4478000-memory.dmp

Download

memory/2632-1457-0x000001D1B4480000-0x000001D1B461A000-memory.dmp

Download

memory/2892-1472-0x000001F3BBF00000-0x000001F3BC09A000-memory.dmp

Download

memory/3104-1437-0x000002DEFF680000-0x000002DEFF81A000-memory.dmp

Download

memory/3104-1436-0x000002DEFF300000-0x000002DEFF678000-memory.dmp

Download

memory/3200-2649-0x000002342B9A0000-0x000002342B9B0000-memory.dmp

Download

memory/3388-3244-0x0000028396D40000-0x0000028396EDA000-memory.dmp

Download

memory/3388-3243-0x0000028397700000-0x0000028397A78000-memory.dmp

Download

memory/3420-588-0x00007FF8826E7000-0x00007FF8826E8000-memory.dmp

Download

memory/3456-1438-0x000001ECF7B00000-0x000001ECF7E78000-memory.dmp

Download

memory/3456-1439-0x000001ECF7E80000-0x000001ECF801A000-memory.dmp

Download

memory/3628-2580-0x0000020546380000-0x000002054651A000-memory.dmp

Download

memory/3628-2579-0x0000020546000000-0x0000020546378000-memory.dmp

Download

memory/3628-3186-0x000001B48D580000-0x000001B48D71A000-memory.dmp

Download

memory/3628-3185-0x000001B48D200000-0x000001B48D578000-memory.dmp

Download

memory/3676-3190-0x000001AC9C280000-0x000001AC9C41A000-memory.dmp

Download

memory/3676-3189-0x000001AC9BF00000-0x000001AC9C278000-memory.dmp

Download

memory/3696-3574-0x000001CCB9680000-0x000001CCB981A000-memory.dmp

Download

memory/3696-3573-0x000001CCB9300000-0x000001CCB9678000-memory.dmp

Download

memory/3756-1950-0x0000022A41080000-0x0000022A4121A000-memory.dmp

Download

memory/3756-1949-0x0000022A40D00000-0x0000022A41078000-memory.dmp

Download

memory/3952-878-0x0000025D4E200000-0x0000025D4E578000-memory.dmp

Download

memory/3952-737-0x00007FF8870A0000-0x00007FF8870A1000-memory.dmp

Download

memory/3952-732-0x00007FF885F10000-0x00007FF885F11000-memory.dmp

Download

memory/3952-730-0x00007FF886170000-0x00007FF886171000-memory.dmp

Download

memory/3952-879-0x0000025D4E580000-0x0000025D4E71A000-memory.dmp

Download

memory/4372-1455-0x000002742EEC0000-0x000002742F05A000-memory.dmp

Download

memory/4372-1454-0x000002742EB40000-0x000002742EEB8000-memory.dmp

Download

memory/4464-893-0x000001FA96BE0000-0x000001FA96BF0000-memory.dmp

Download

memory/4464-733-0x000001FA96BA0000-0x000001FA96BB0000-memory.dmp

Download

memory/4604-2581-0x000001A684600000-0x000001A684978000-memory.dmp

Download

memory/4604-2582-0x000001A684980000-0x000001A684B1A000-memory.dmp

Download

memory/4732-2583-0x0000018F09A00000-0x0000018F09D78000-memory.dmp

Download

memory/4732-2584-0x0000018F09D80000-0x0000018F09F1A000-memory.dmp

Download

memory/4756-3805-0x0000018441180000-0x000001844131A000-memory.dmp

Download

memory/4944-2578-0x00000220A5580000-0x00000220A571A000-memory.dmp

Download

memory/4944-2577-0x00000220A5F00000-0x00000220A6278000-memory.dmp

Download

memory/5080-2574-0x0000020407700000-0x000002040789A000-memory.dmp

Download

memory/5212-3188-0x00000235DC580000-0x00000235DC71A000-memory.dmp

Download

memory/5212-3187-0x00000235DC200000-0x00000235DC578000-memory.dmp

Download

memory/5328-3184-0x0000020BF3600000-0x0000020BF379A000-memory.dmp

Download

memory/5704-1452-0x0000020D9D800000-0x0000020D9DB78000-memory.dmp

Download

memory/5704-1453-0x0000020D9DB80000-0x0000020D9DD1A000-memory.dmp

Download

memory/5788-3192-0x0000021F20C80000-0x0000021F20E1A000-memory.dmp

Download

memory/5788-3191-0x0000021F20900000-0x0000021F20C78000-memory.dmp

Download

memory/6060-3193-0x000001B16E900000-0x000001B16EC78000-memory.dmp

Download

memory/6060-3194-0x000001B16EC80000-0x000001B16EE1A000-memory.dmp

Download

memory/6416-2572-0x0000022F3C200000-0x0000022F3C578000-memory.dmp

Download

memory/6416-2573-0x0000022F3C580000-0x0000022F3C71A000-memory.dmp

Download

memory/6496-3375-0x000001AEA2580000-0x000001AEA271A000-memory.dmp

Download

memory/6496-3374-0x000001AEA2200000-0x000001AEA2578000-memory.dmp

Download

memory/6688-3554-0x000001A020880000-0x000001A020A1A000-memory.dmp

Download

memory/6688-3553-0x000001A020500000-0x000001A020878000-memory.dmp

Download

memory/6824-2575-0x000002048CC00000-0x000002048CF78000-memory.dmp

Download

memory/6824-2576-0x000002048CF80000-0x000002048D11A000-memory.dmp

Download

memory/6968-1482-0x000001FFB9DF0000-0x000001FFB9F8A000-memory.dmp

Download

memory/6968-1481-0x000001FFBA700000-0x000001FFBAA78000-memory.dmp

Download

memory/7008-3182-0x00000297C0400000-0x00000297C0778000-memory.dmp

Download

memory/7008-3183-0x00000297C0780000-0x00000297C091A000-memory.dmp

Download