Overview

overview

10

Static

static

3

2026-06-26...lc.exe

windows10-2004-x64

10

2026-06-26...lc.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    56s
  • max time network
    160s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_cf04f7c15ad45407e123653c79c0818d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 108.8MB
  • Sample260629-pc1mksew2l
  • SHA256 3ff9ad301ec0d2ff2be86c87ec18075b28a2329651a8b1922615b3d28994665f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarebackdoordefense_evasionhavocpersistencespywaretrojan

Malware Config

Extracted

Family

  • havoc

C2

  • 192.168.68.108

Attributes
  • spawn

    C:\Windows\System32\notepad.exe

    C:\Windows\SysWOW64\notepad.exe

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36

Signatures

  • Family: Havoc, HavocC2

    Havoc is an open-source backdoor and post-exploitation framework written in C++.

    backdoorhavoc
  • Detects Havoc payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 61 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_cf04f7c15ad45407e123653c79c0818d_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_cf04f7c15ad45407e123653c79c0818d_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Users\Admin\AppData\Local\Temp\havoc.exe
        havoc.exe
        3⤵
        • Executes dropped EXE
        PID:5644
      • C:\Users\Admin\AppData\Local\Temp\tor-browser-windows-x86_64-portable-15.0.15.exe
        tor-browser-windows-x86_64-portable-15.0.15.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5864
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
            "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Checks system information in the registry
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1252
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260602115755 -prefsHandle 2616:26449 -prefMapHandle 2620:276329 -ipcHandle 2652 -initialChannelId {298003d0-76a1-44d9-89db-c1c2b34e8188} -parentPid 1252 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:556
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1788:27031 -prefMapHandle 1852:276329 -jsInitHandle 2316:242716 -parentBuildID 20260602115755 -ipcHandle 1704 -initialChannelId {00e20ea0-840f-4583-a3d7-7431b5632866} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:5576
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260602115755 -prefsHandle 2164:27716 -prefMapHandle 2168:276329 -ipcHandle 2904 -initialChannelId {19864917-33d2-4fea-be5e-5b4ab941d71d} -parentPid 1252 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1136
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3372:27778 -prefMapHandle 3376:276329 -jsInitHandle 3380:242716 -parentBuildID 20260602115755 -ipcHandle 1900 -initialChannelId {bd86c281-a322-4b7f-b443-4c2d2f788471} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1540
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3672:27854 -prefMapHandle 3676:276329 -jsInitHandle 3680:242716 -parentBuildID 20260602115755 -ipcHandle 3688 -initialChannelId {491173b5-88d8-46be-81b4-64eb8042caa9} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:2332
            • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:a212eaea34899c6760d620063bc6c3d76655a4b9c2b3d96f4935a6c637 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1252 DisableNetwork 1
              6⤵
              • Executes dropped EXE
              PID:4284
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260602115755 -sandboxingKind 0 -prefsHandle 3308:29643 -prefMapHandle 3300:276329 -ipcHandle 3236 -initialChannelId {174b7465-94d2-4ed9-b463-6e2b84239d2e} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 utility
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1772
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4104:28693 -prefMapHandle 4132:276329 -jsInitHandle 4148:242716 -parentBuildID 20260602115755 -ipcHandle 4156 -initialChannelId {4d206437-79d6-46be-aa06-876be2f019ff} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:6584
            • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4372:28963 -prefMapHandle 4272:276329 -jsInitHandle 4276:242716 -parentBuildID 20260602115755 -ipcHandle 2364 -initialChannelId {1ab7224f-9a01-4100-a925-b932bc51d560} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
              6⤵
                PID:1944
              • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4468:28963 -prefMapHandle 4472:276329 -jsInitHandle 4476:242716 -parentBuildID 20260602115755 -ipcHandle 4484 -initialChannelId {6843f9fd-01b9-4e4d-948e-8a8c63a86cdb} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
                6⤵
                  PID:5940
                • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                  "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4656:28963 -prefMapHandle 4660:276329 -jsInitHandle 4664:242716 -parentBuildID 20260602115755 -ipcHandle 4672 -initialChannelId {43fa97d6-2926-475a-944a-d0805ee61a59} -parentPid 1252 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
                  6⤵
                    PID:3428
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5772
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:3068
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4176
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2228

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              prep_Activatable Class_Hermes_perf.cache
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
              • Size 595B
              • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              havoc.exe
              • Path C:\Users\Admin\AppData\Local\Temp\havoc.exe
              • Size 100KB
              • SHA256 21d03cf57c117cf19b85dca079f2a8d24cbf8ef033182be6351814e9fd7c52ca
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              LangDLL.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsaF78C.tmp\LangDLL.dll
              • Size 7KB
              • SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsaF78C.tmp\System.dll
              • Size 23KB
              • SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              nsDialogs.dll
              • Path C:\Users\Admin\AppData\Local\Temp\nsaF78C.tmp\nsDialogs.dll
              • Size 13KB
              • SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              run.bat
              • Path C:\Users\Admin\AppData\Local\Temp\run.bat
              • Size 70B
              • SHA256 fb6fe5812ced389916e0873b9d517140d9151e4004c511c4fa1825b7bb4772ba
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.bin
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
              • Size 82B
              • SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
              • Size 82B
              • SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
              • Size 82B
              • SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
              • Size 82B
              • SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
              • Size 82B
              • SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.tmp
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
              • Size 82B
              • SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              extensions.json
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
              • Size 17KB
              • SHA256 000b9046ce50aa9986de3fc35124accb937382888d802461ead5cd39ef67dd3f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
              • Size 5KB
              • SHA256 b077cd741190100ea7d15e3c095a1683716538b2c2c1d7a45ec98a1f24f07610
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
              • Size 4KB
              • SHA256 40137a29fd5f4b68d23739f7b164b91c9946cfb6c47c4027bda6b3757cfea9d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs-1.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
              • Size 5KB
              • SHA256 e20846791cad7134764c75cb38f3a8d4f78aa6ed2a0880991ededf360ef66252
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
              • Size 795B
              • SHA256 0499b3a1e15cc28bf0d65ba5c49bd63c3b1bca9e7a585c4193e99aedf7dcd436
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
              • Size 2KB
              • SHA256 e4f77a6d80e42217121bb36b60c2fb2b6b73daea77026d7cfd820aecbe972b2b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              prefs.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
              • Size 4KB
              • SHA256 4ed4684a54372fed871711f208f1b3b486ce2040e1bd57bd4fac2d0374ddcf7b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              3870112724rsegmnoittet-es.sqlite
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
              • Size 472KB
              • SHA256 499c4f59f76c3fe3b1da9a20f770d23d2d536697de8083e0be49d5237315ff3d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              profiles.ini
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
              • Size 103B
              • SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              omni.ja
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
              • Size 26.6MB
              • SHA256 fffc758be7c7aec259fe46259dc21bf8fb4fd7b638fd41dbeed9ce4e44c2721d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              channel-prefs.js
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
              • Size 429B
              • SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              dependentlibs.list
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
              • Size 55B
              • SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
              • Size 822KB
              • SHA256 3950a8844d70dd4ab1cc8c349d779a46d01da2a631607c39a471c7e5749afa21
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              firefox.exe
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
              • Size 1.7MB
              • SHA256 c1874de8b97e2f465bd06932157289994617145634b8c30389d09316fd2fd480
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              000_README.txt
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
              • Size 296B
              • SHA256 14014e6904c0a496afaf2a7ba6f63926d16d4e8695862d3af439954434765de1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              NotoNaskhArabic-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf
              • Size 239KB
              • SHA256 2d5d78e9cc27d7193926c7e460314c9da7dbec1268494dbf117adc53c171ac06
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSans-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf
              • Size 596KB
              • SHA256 61b72eacd39533f0e5916cbb458abd7b3cf870667f63f3069dac2a75aa0317a2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansAdlam-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansAdlam-Regular.ttf
              • Size 91KB
              • SHA256 4b51541536a7b28142a4571c16dc56e386c05f345ac9739ef8599d8ad4ed5e54
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBalinese-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBalinese-Regular.ttf
              • Size 90KB
              • SHA256 cee58a184e7e00c4332087ac01870a69ac52fd5fa17ea3783ac728c945af1827
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBamum-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBamum-Regular.ttf
              • Size 224KB
              • SHA256 0282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBassaVah-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBassaVah-Regular.ttf
              • Size 7KB
              • SHA256 8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBatak-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBatak-Regular.ttf
              • Size 21KB
              • SHA256 2ce9e91aa89c2aab44bb7bf944b0f445bd36f1a51ea21b7848e976182a541e00
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBengali-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBengali-Regular.ttf
              • Size 198KB
              • SHA256 9f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBuginese-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuginese-Regular.ttf
              • Size 7KB
              • SHA256 bc19f17d7f6e8f280c2cc95ef6d1b67fac25becfe98722f482039a4d84f3c9ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansBuhid-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuhid-Regular.ttf
              • Size 5KB
              • SHA256 328d80e11e7f65f9b6e4bac12de32b7ce42154301c2a14ba92155e32e05939d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansCanadianAboriginal-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCanadianAboriginal-Regular.ttf
              • Size 172KB
              • SHA256 6f489ba696faff1d96f8ace395c0d22fe3b82621f69bf50b337112fb47ff1f17
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansChakma-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansChakma-Regular.ttf
              • Size 80KB
              • SHA256 60ce1d029e35b432dd68cc9f6c94f69bd84d8c97f28f06130186606dd2c3325d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansCham-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCham-Regular.ttf
              • Size 31KB
              • SHA256 d48a34e02b4096eb3f2e008b74459789540598c2274d65fc53012517d0b08d92
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansCherokee-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCherokee-Regular.ttf
              • Size 92KB
              • SHA256 c052352137ae8d283840a0e2991a675d47859d8fdbae5726d373d4f0d97a8c87
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansCoptic-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCoptic-Regular.ttf
              • Size 47KB
              • SHA256 e70bd535d7e6cdf2346eab36ea76441059b18ee14d3243e85240b5e65eb0ad45
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansDeseret-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansDeseret-Regular.ttf
              • Size 19KB
              • SHA256 9f384e8a75a059b8efcbead73ef5aa3b504ac3e9d218be5368a20b19bfccdeec
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansDevanagari-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansDevanagari-Regular.ttf
              • Size 238KB
              • SHA256 306b53ecfb182a504dd8a7446093c316387d2fd8dc350d0792ed1753fe0996cd
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansElbasan-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansElbasan-Regular.ttf
              • Size 18KB
              • SHA256 6d52707e91a77e23f389f42b5da65d7047205e7833041fe0b2cd7ff280e14749
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              NotoSansEthiopic-Regular.ttf
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansEthiopic-Regular.ttf
              • Size 367KB
              • SHA256 f6f7fc379db9438959a2b0527e7a2cf36ea9c84626d56ec444fff37fc24c3c10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              freebl3.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
              • Size 941KB
              • SHA256 a7714751158f62daffa8e2e021533e0976a06ba47d37f0e7341da2524fcdfedf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              gkcodecs.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
              • Size 8.8MB
              • SHA256 15a0ff589ad1380dfd7db0ecca7d0be6e1e3c24b3bc0452001638df0d9963b1b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              lgpllibs.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
              • Size 343KB
              • SHA256 04b8dde5e841c60a1e8f846b24c114065ccd6ff7c2bb2015d720cb4293345918
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mozglue.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
              • Size 975KB
              • SHA256 47a386753cebdc6061a03e3ff57875e1d0c893ba64cdaadc85069425a68f861c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              nss3.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
              • Size 2.6MB
              • SHA256 903d71911c7e6b69709aba3cc9924b874b2107d6d64b8d9995ff140cacbbc91a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              omni.ja
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
              • Size 19.5MB
              • SHA256 836e41c9440d62d12a6243dba870714559abb1b4b8d98a23bc82544f3ee487a3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              softokn3.dll
              • Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
              • Size 281KB
              • SHA256 dbaed16f564cb67dec0e003b82166f0a520467e057cbf66f5269dae9d49ac1ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tor Browser.lnk
              • Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
              • Size 809B
              • SHA256 eb42317d10df8b08bf0def671f3062c3f95d461dd41784f4bf8f6d22253c12bf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1252-475-0x0000017AC1030000-0x0000017AC1040000-memory.dmp
              Download

              memory/1540-1194-0x000001BB6A000000-0x000001BB6A37C000-memory.dmp
              Download

              memory/1540-1195-0x000001BB6A380000-0x000001BB6A519000-memory.dmp
              Download

              memory/1772-1231-0x00000263FA000000-0x00000263FA199000-memory.dmp
              Download

              memory/1944-1248-0x00000156C8580000-0x00000156C8719000-memory.dmp
              Download

              memory/1944-1247-0x00000156C8200000-0x00000156C857C000-memory.dmp
              Download

              memory/2332-1196-0x000001ACD0200000-0x000001ACD057C000-memory.dmp
              Download

              memory/2332-1197-0x000001ACD0580000-0x000001ACD0719000-memory.dmp
              Download

              memory/3068-1240-0x000000000ED00000-0x000000000F57B000-memory.dmp
              Download

              memory/3428-1252-0x0000018F06C00000-0x0000018F06F7C000-memory.dmp
              Download

              memory/3428-1253-0x0000018F06F80000-0x0000018F07119000-memory.dmp
              Download

              memory/4176-1027-0x0000020283C30000-0x0000020283D30000-memory.dmp
              Download

              memory/4176-1008-0x0000020280000000-0x0000020280100000-memory.dmp
              Download

              memory/4176-1025-0x0000020280FD0000-0x0000020280FF0000-memory.dmp
              Download

              memory/4176-1043-0x0000020283BB0000-0x0000020283BD0000-memory.dmp
              Download

              memory/4176-1057-0x0000020283FB0000-0x0000020283FD0000-memory.dmp
              Download

              memory/4176-1009-0x0000020280000000-0x0000020280100000-memory.dmp
              Download

              memory/5576-960-0x00000212B1280000-0x00000212B1419000-memory.dmp
              Download

              memory/5576-949-0x00000212B0F00000-0x00000212B127C000-memory.dmp
              Download

              memory/5576-372-0x00007FFE03C30000-0x00007FFE03C31000-memory.dmp
              Download

              memory/5576-373-0x00007FFE05190000-0x00007FFE05191000-memory.dmp
              Download

              memory/5576-371-0x00007FFE03FB0000-0x00007FFE03FB1000-memory.dmp
              Download

              memory/5940-1250-0x000001E249680000-0x000001E249819000-memory.dmp
              Download

              memory/5940-1249-0x000001E249300000-0x000001E24967C000-memory.dmp
              Download

              memory/6584-1233-0x000001F968880000-0x000001F968A19000-memory.dmp
              Download

              memory/6584-1232-0x000001F968500000-0x000001F96887C000-memory.dmp
              Download