Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • max time kernel
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/07/2026, 21:33

General

  • Target
    tor-browser-windows-x86_64-portable-15.0.17 (1).exe
  • Size 108.2MB
  • Sample260706-1eptmshs4r
  • SHA256 13d3e0a229443b643c683de1615456ace7632f4d801b62720a9390ad953f8c80
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tor-browser-windows-x86_64-portable-15.0.17 (1).exe
    "C:\Users\Admin\AppData\Local\Temp\tor-browser-windows-x86_64-portable-15.0.17 (1).exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4576
    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Checks system information in the registry
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 2668:26449 -prefMapHandle 2672:276393 -ipcHandle 2716 -initialChannelId {a5765244-080d-426f-8ad8-4c657fd3e7fa} -parentPid 964 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4272
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2344:27031 -prefMapHandle 2348:276393 -jsInitHandle 2340:242716 -parentBuildID 20260628123000 -ipcHandle 2932 -initialChannelId {343b7fc7-dfac-4de7-bd3b-6749ffee1984} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:5308
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 3056:27361 -prefMapHandle 3060:276393 -ipcHandle 3096 -initialChannelId {de43078e-048f-4b28-b4d7-e936de1985e0} -parentPid 964 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2564
        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:d802e294739b2b2c60abde3ba40b2395174468f40afcdd138cb8da571e +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 964 DisableNetwork 1
          4⤵
          • Executes dropped EXE
          PID:4648
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1768:27778 -prefMapHandle 2028:276393 -jsInitHandle 1516:242716 -parentBuildID 20260628123000 -ipcHandle 2900 -initialChannelId {de34b0f2-3dd4-43c5-9a4a-d4d073ce24e6} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:4764
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3744:27854 -prefMapHandle 3748:276393 -jsInitHandle 3752:242716 -parentBuildID 20260628123000 -ipcHandle 1908 -initialChannelId {06b30ea3-69dd-45c5-bf17-d282e30c4a75} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:2348
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -sandboxingKind 0 -prefsHandle 3452:29643 -prefMapHandle 3548:276393 -ipcHandle 3544 -initialChannelId {01ec8ef2-3acf-45f3-9843-fe242bd3f09e} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 utility
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:2480
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4200:28693 -prefMapHandle 4204:276393 -jsInitHandle 4208:242716 -parentBuildID 20260628123000 -ipcHandle 4216 -initialChannelId {f986bf1c-1792-47e2-bad0-338eeadf6105} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:1656
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3328:28963 -prefMapHandle 3488:276393 -jsInitHandle 3492:242716 -parentBuildID 20260628123000 -ipcHandle 1864 -initialChannelId {bb10fd79-92d8-4f34-a08e-fee931a5f4ea} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          PID:1748
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2008:28963 -prefMapHandle 1492:276393 -jsInitHandle 2668:242716 -parentBuildID 20260628123000 -ipcHandle 1412 -initialChannelId {a04b1f6a-11cd-4915-82f1-eb389b2eb15f} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:4020
        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4716:28963 -prefMapHandle 4720:276393 -jsInitHandle 4724:242716 -parentBuildID 20260628123000 -ipcHandle 4732 -initialChannelId {f3464beb-6588-4502-ad8f-27b4e8ef584d} -parentPid 964 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:4208

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LangDLL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse404.tmp\LangDLL.dll
        • Size 7KB
        • SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse404.tmp\System.dll
        • Size 23KB
        • SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nse404.tmp\nsDialogs.dll
        • Size 13KB
        • SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data.safe.bin

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
        • Size 82B
        • SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 82B
        • SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 82B
        • SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 82B
        • SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 140B
        • SHA256 099dd19f45e7310bc4a028ac2ebced52b8ec8359b655e1f2c549e9d9a7a908c5
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 82B
        • SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 82B
        • SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
        • MD5 SHA1 SHA512 TLSH

        data.safe.tmp

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
        • Size 1KB
        • SHA256 f7db330b03f15764f7b465f51820829d5dc5f7e01787a5c0cd316ec3fb4d307e
        • MD5 SHA1 SHA512 TLSH

        extensions.json

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
        • Size 17KB
        • SHA256 9a07b5a74cf046b5e6c0d6f83aba4d1a4f2dadd7ceb252fb97067baee4d1e201
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prefs-1.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
        • Size 5KB
        • SHA256 41e10276a6d03b01b80d9cf8bc14c592c3215883616808f3bddc31109ac5f3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prefs-1.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
        • Size 4KB
        • SHA256 012e6adb4ee05a81563650ec1e5862a780ab0c78a9645d48c51b221bc67a888a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prefs.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
        • Size 2KB
        • SHA256 f17e19b2959b917ba23479c43b38dd4cb5bd8e3ba58ad48981251e6e1a3ca383
        • MD5 SHA1 SHA512 TLSH

        prefs.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
        • Size 660B
        • SHA256 602a6a3bfcfab031fa7d0cba6cd96158a7443ee76b08d57af64f3f980bff87f3
        • MD5 SHA1 SHA512 TLSH

        prefs.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
        • Size 4KB
        • SHA256 0e22aa50b52e61eb8a5170eb651ac9a5215825af60160f6447d3dcca31d612c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        3870112724rsegmnoittet-es.sqlite

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
        • Size 200KB
        • SHA256 4eca2433b59e895679bd3c09f43d21e5b36c109379b9bf0b6af8fbd55f8e005b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        profiles.ini

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
        • Size 103B
        • SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
        • MD5 SHA1 SHA512 TLSH

        omni.ja

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
        • Size 26.6MB
        • SHA256 f420000c2cbbd4a21c9c568f21ed9e8f8699e56c5af36bbb4e53287aea44a07f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        channel-prefs.js

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
        • Size 429B
        • SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
        • MD5 SHA1 SHA512 TLSH

        dependentlibs.list

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
        • Size 55B
        • SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
        • MD5 SHA1 SHA512 TLSH

        {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
        • Size 822KB
        • SHA256 e6329c6a9a6e4e9d2b56606e34a5eca53b9dda8204a185d562a53885df0b0afc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        firefox.exe

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        • Size 1.7MB
        • SHA256 241366fae863e43e7a046b66c820c12771f030b6b4590cf5fb2646a4f44de074
        • MD5 SHA1 SHA512 SSDEEP TLSH

        000_README.txt

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\000_README.txt
        • Size 296B
        • SHA256 14014e6904c0a496afaf2a7ba6f63926d16d4e8695862d3af439954434765de1
        • MD5 SHA1 SHA512 TLSH

        NotoNaskhArabic-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoNaskhArabic-Regular.ttf
        • Size 239KB
        • SHA256 2d5d78e9cc27d7193926c7e460314c9da7dbec1268494dbf117adc53c171ac06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSans-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSans-Regular.ttf
        • Size 596KB
        • SHA256 61b72eacd39533f0e5916cbb458abd7b3cf870667f63f3069dac2a75aa0317a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansAdlam-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansAdlam-Regular.ttf
        • Size 91KB
        • SHA256 4b51541536a7b28142a4571c16dc56e386c05f345ac9739ef8599d8ad4ed5e54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBalinese-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBalinese-Regular.ttf
        • Size 90KB
        • SHA256 cee58a184e7e00c4332087ac01870a69ac52fd5fa17ea3783ac728c945af1827
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBamum-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBamum-Regular.ttf
        • Size 224KB
        • SHA256 0282610e6923d06a4d120cff3824e829b4535a8c4c57c07e11dbe73475541084
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBassaVah-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBassaVah-Regular.ttf
        • Size 7KB
        • SHA256 8218239377452e05634a91ee8a4338daf0aa96a15673a437533a098eb9c06f53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBatak-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBatak-Regular.ttf
        • Size 21KB
        • SHA256 2ce9e91aa89c2aab44bb7bf944b0f445bd36f1a51ea21b7848e976182a541e00
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBengali-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBengali-Regular.ttf
        • Size 198KB
        • SHA256 9f8b4dd091f19b111d24ea18daae81bea8684cc67de17ea1acd797e144bf20ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBuginese-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuginese-Regular.ttf
        • Size 7KB
        • SHA256 bc19f17d7f6e8f280c2cc95ef6d1b67fac25becfe98722f482039a4d84f3c9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansBuhid-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansBuhid-Regular.ttf
        • Size 5KB
        • SHA256 328d80e11e7f65f9b6e4bac12de32b7ce42154301c2a14ba92155e32e05939d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansCanadianAboriginal-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCanadianAboriginal-Regular.ttf
        • Size 172KB
        • SHA256 6f489ba696faff1d96f8ace395c0d22fe3b82621f69bf50b337112fb47ff1f17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansChakma-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansChakma-Regular.ttf
        • Size 80KB
        • SHA256 60ce1d029e35b432dd68cc9f6c94f69bd84d8c97f28f06130186606dd2c3325d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansCham-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCham-Regular.ttf
        • Size 31KB
        • SHA256 d48a34e02b4096eb3f2e008b74459789540598c2274d65fc53012517d0b08d92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansCherokee-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCherokee-Regular.ttf
        • Size 92KB
        • SHA256 c052352137ae8d283840a0e2991a675d47859d8fdbae5726d373d4f0d97a8c87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansCoptic-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansCoptic-Regular.ttf
        • Size 47KB
        • SHA256 e70bd535d7e6cdf2346eab36ea76441059b18ee14d3243e85240b5e65eb0ad45
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansDeseret-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansDeseret-Regular.ttf
        • Size 19KB
        • SHA256 9f384e8a75a059b8efcbead73ef5aa3b504ac3e9d218be5368a20b19bfccdeec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansDevanagari-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansDevanagari-Regular.ttf
        • Size 238KB
        • SHA256 306b53ecfb182a504dd8a7446093c316387d2fd8dc350d0792ed1753fe0996cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansElbasan-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansElbasan-Regular.ttf
        • Size 18KB
        • SHA256 6d52707e91a77e23f389f42b5da65d7047205e7833041fe0b2cd7ff280e14749
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansEthiopic-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansEthiopic-Regular.ttf
        • Size 367KB
        • SHA256 f6f7fc379db9438959a2b0527e7a2cf36ea9c84626d56ec444fff37fc24c3c10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansGeorgian-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansGeorgian-Regular.ttf
        • Size 51KB
        • SHA256 d3e33254b09e7bb2c5cf0f17e554b80462056c5a107097f258d495168c3a9346
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansGrantha-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansGrantha-Regular.ttf
        • Size 355KB
        • SHA256 41dd39f2f16e9539751c732f8d276079b98277bec2ea5945232a7ac594198000
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansGujarati-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansGujarati-Regular.ttf
        • Size 196KB
        • SHA256 9b5a7aaeeb649a2e75a49d8b006a1f87db1b61c0df3b001609f4e0725d88dbf6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansGunjalaGondi-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansGunjalaGondi-Regular.ttf
        • Size 68KB
        • SHA256 bdc8ed1739118d7c1be43cb5b435817fb7a5ae0acb32c89b2ddd66e7e9c2d1b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NotoSansGurmukhi-Regular.ttf

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\fonts\NotoSansGurmukhi-Regular.ttf
        • Size 53KB
        • SHA256 658d0207da305a1411c539a8b0bbeda64d4146e54fb4827facddb890b6b90d74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        freebl3.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
        • Size 941KB
        • SHA256 b273569349e13da771557f3d844dfb315cd5e659f04e867a2cd6a221ad7acd57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gkcodecs.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
        • Size 8.8MB
        • SHA256 37138754f0e3664b6333d66a740381893d213cbeeb5b7d4572de12af147b8411
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lgpllibs.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
        • Size 344KB
        • SHA256 550ab64ff0d6a8009b53b986e56f57ada23e52bc715f17a4e4745d7ef4999798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mozglue.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
        • Size 975KB
        • SHA256 de4a5fdf5cc1a516b578e2936337e6adaeae203f5ff5a78f44303ec6799c9b52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nss3.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
        • Size 2.6MB
        • SHA256 5d57885a87137322b7177c1658574632159699786dd5c6e83a46de760d18aa12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        omni.ja

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
        • Size 19.5MB
        • SHA256 5c74189d15107ad5a502c63eef8b7d484a6821adba387583e192a93285ada6cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        softokn3.dll

        • Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
        • Size 281KB
        • SHA256 5d2941bec7c077e2060378059c703dc3bd9cd713ed66c4cd3d62b840bad78f2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Tor Browser.lnk

        • Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
        • Size 829B
        • SHA256 99523baec5bb8cf90709cf2b995f7cc7aa8d8ff4c0cf867f400b17e76aeb92f7
        • MD5 SHA1 SHA512 TLSH

        memory/964-937-0x0000023103AB0000-0x0000023103AC0000-memory.dmp

        memory/964-355-0x0000023103A60000-0x0000023103A70000-memory.dmp

        memory/1656-974-0x00000194D1E50000-0x00000194D1F26000-memory.dmp

        memory/1748-979-0x00000214BC900000-0x00000214BC9D6000-memory.dmp

        memory/2348-966-0x000001A800B00000-0x000001A800BD6000-memory.dmp

        memory/2480-973-0x0000024E62800000-0x0000024E628D6000-memory.dmp

        memory/2564-964-0x0000015043900000-0x0000015043B84000-memory.dmp

        memory/4020-980-0x00000203CF400000-0x00000203CF4D6000-memory.dmp

        memory/4208-981-0x0000024068400000-0x00000240684D6000-memory.dmp

        memory/4272-963-0x000002A7E3300000-0x000002A7E3584000-memory.dmp

        memory/4576-194-0x00007FF8B75F7000-0x00007FF8B75F8000-memory.dmp

        memory/4764-965-0x00000278CE940000-0x00000278CEA16000-memory.dmp

        memory/5308-920-0x000001B7E0D00000-0x000001B7E0DD6000-memory.dmp

        memory/5308-350-0x00007FF8BB0D0000-0x00007FF8BB0D1000-memory.dmp

        memory/5308-349-0x00007FF8BC7B0000-0x00007FF8BC7B1000-memory.dmp

        memory/5308-351-0x00007FF8BBF80000-0x00007FF8BBF81000-memory.dmp