Overview

overview

10

Static

static

3

e8c6741d3d...16.exe

windows10-2004-x64

10

Resubmissions

13/07/2026, 12:39

260713-pv3jwsbs8t10

05/02/2022, 21:17

220205-z43lcsfeg610

Analysis

  • user interaction
    yes
  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/07/2026, 12:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe
  • Size 112KB
  • Sample260713-pv3jwsbs8t
  • SHA256 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistenceransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Default\# DECRYPT MY FILES #.txt

Ransom Note
  • C E R B E R ----------- Your documents, photos, databases and other important files have been encrypted! To decrypt your files follow the instructions: --------------------------------------------------------------------------------------- 1. Download and install the "Tor Browser" from https://www.torproject.org/ 2. Run it 3. In the "Tor Browser" open website: http://decrypttozxybarc.onion/D2A7-F768-6D53-0006-404A 4. Follow the instructions at this website --------------------------------------------------------------------------------------- �...Quod me non necat me fortiorem facit.�
URLs

  • http://decrypttozxybarc.onion/D2A7-F768-6D53-0006-404A

Signatures

  • Contacts a large (8233) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Adds policy Run key to start application 2 TTPs 7 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 28 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Control Panel 14 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 5 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe
    "C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe"
    1⤵
    • Adds policy Run key to start application
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
      "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe"
      2⤵
      • Adds policy Run key to start application
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
        "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe" -watchdog
        3⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
      • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
        "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe" -stat 92
        3⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies Control Panel
        • Suspicious use of AdjustPrivilegeToken
        PID:4520
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        3⤵
          PID:4092
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
          3⤵
          • Drops file in Program Files directory
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2288
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ff92eb0c188,0x7ff92eb0c194,0x7ff92eb0c1a0
            4⤵
              PID:5116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,4634856397131813864,10283575829924841278,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:3
              4⤵
              • Downloads MZ/PE file
              • System Time Discovery
              PID:3692
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,3175910150718676613,15044545121478242012,262144 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:2
              4⤵
                PID:4300
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,1235205367934689682,4983400296083214542,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8
                4⤵
                  PID:3860
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,10181729977336595348,17801514126356730544,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                  4⤵
                    PID:3216
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,625489227220660995,18317847779989950053,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
                    4⤵
                      PID:4628
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,5347433374892104140,1310217105224409727,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                      4⤵
                        PID:4368
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10313469252017196204,15287836848884999407,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
                        4⤵
                          PID:4580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,13993458063994618042,17036066358101484002,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
                          4⤵
                            PID:3264
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,16658423090537248236,3832924172211415956,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
                            4⤵
                              PID:2284
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,556615269991956741,3040122929567038963,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
                              4⤵
                                PID:4812
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2284982832490030487,15075757624023575638,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
                                4⤵
                                  PID:3508
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11023749134079428280,4255581509034091000,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
                                  4⤵
                                    PID:384
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11023749134079428280,4255581509034091000,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
                                    4⤵
                                      PID:2320
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,8073465287032939092,9952700619140375187,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
                                      4⤵
                                        PID:4844
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,10364992416025271958,10957021700715614727,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
                                        4⤵
                                          PID:4224
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8754611152431863629,14773898714144225617,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
                                          4⤵
                                            PID:5040
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15288892345357389762,14626674749996528391,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
                                            4⤵
                                              PID:1764
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14168361345270636668,4210456574385763983,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
                                              4⤵
                                                PID:976
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,13297698387129613354,3928455672062835876,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
                                                4⤵
                                                  PID:4060
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6684,i,12672470610723598486,5500090641038236174,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
                                                  4⤵
                                                    PID:5092
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6864,i,6177130750339988306,13153010794545635116,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:1
                                                    4⤵
                                                      PID:5360
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,13857985452485911565,4956298946642509631,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
                                                      4⤵
                                                        PID:5716
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,3802160832414278448,6538998687779134644,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
                                                        4⤵
                                                          PID:5452
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,2479881429310239923,10460339436695675342,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
                                                          4⤵
                                                            PID:4020
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,1399647120775171727,7559081749069395030,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
                                                            4⤵
                                                              PID:5524
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=4336,i,17423485920450143839,10676487161783514293,2097152 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
                                                              4⤵
                                                                PID:4292
                                                              • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.17.exe
                                                                "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.17.exe"
                                                                4⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies registry class
                                                                • Suspicious use of FindShellTrayWindow
                                                                PID:5804
                                                                • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                  "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:5412
                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                    6⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Checks whether UAC is enabled
                                                                    • Checks system information in the registry
                                                                    • Checks processor information in registry
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4328
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 2284:26451 -prefMapHandle 2288:276393 -ipcHandle 2332 -initialChannelId {6afb2857-e582-424a-8273-108e30085901} -parentPid 4328 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:5308
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2104:27031 -prefMapHandle 2548:276393 -jsInitHandle 2604:242716 -parentBuildID 20260628123000 -ipcHandle 2672 -initialChannelId {76611bfe-7f20-4196-8c69-5d177898235f} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:3328
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -prefsHandle 2904:27718 -prefMapHandle 2908:276393 -ipcHandle 2976 -initialChannelId {db6c1b31-957b-413e-b353-f15975e3bfd6} -parentPid 4328 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:4312
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:e290ad5c2507e630604d782fdcccc212e55676a2e2f891385f609b69a9 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 4328 DisableNetwork 1
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      PID:2176
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860:27780 -prefMapHandle 2832:276393 -jsInitHandle 2836:242716 -parentBuildID 20260628123000 -ipcHandle 2828 -initialChannelId {1a542cb9-337b-422f-98cf-5a353fd0386e} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:5256
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1880:27856 -prefMapHandle 3508:276393 -jsInitHandle 3512:242716 -parentBuildID 20260628123000 -ipcHandle 1792 -initialChannelId {cc98fe1a-c61f-4511-86be-ae1e440f5f85} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:4176
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3752:28012 -prefMapHandle 3748:276393 -jsInitHandle 3744:242716 -parentBuildID 20260628123000 -ipcHandle 3736 -initialChannelId {948d03ca-63a1-48f3-bda3-6081b721f26e} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:5276
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260628123000 -sandboxingKind 0 -prefsHandle 4160:29871 -prefMapHandle 3832:276393 -ipcHandle 4164 -initialChannelId {be357d5f-7ed2-45c2-a829-8e97607847e6} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 utility
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:5892
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4308:28919 -prefMapHandle 4312:276393 -jsInitHandle 4316:242716 -parentBuildID 20260628123000 -ipcHandle 4324 -initialChannelId {ac3d2767-0958-4f07-a85c-4228fcb37e35} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Checks processor information in registry
                                                                      PID:2208
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4352:28919 -prefMapHandle 4356:276393 -jsInitHandle 4360:242716 -parentBuildID 20260628123000 -ipcHandle 4364 -initialChannelId {1313de9b-3035-43c5-a27c-dbbb659ebc2d} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
                                                                      7⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Checks processor information in registry
                                                                      PID:4760
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2712:28919 -prefMapHandle 2792:276393 -jsInitHandle 2796:242716 -parentBuildID 20260628123000 -ipcHandle 2784 -initialChannelId {5fbf9992-fe0f-4e48-916b-b7909fe4fd7a} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Checks processor information in registry
                                                                      PID:8116
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4960:29118 -prefMapHandle 5060:276393 -jsInitHandle 5064:242716 -parentBuildID 20260628123000 -ipcHandle 5072 -initialChannelId {f97650e6-c34b-4128-92ef-9d32dad52f3a} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Checks processor information in registry
                                                                      PID:7488
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3960:29162 -prefMapHandle 3956:276393 -jsInitHandle 4672:242716 -parentBuildID 20260628123000 -ipcHandle 4420 -initialChannelId {49173ae7-f533-4b84-bd40-f7fbe15a2c81} -parentPid 4328 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 12 tab
                                                                      7⤵
                                                                      • Executes dropped EXE
                                                                      • Checks processor information in registry
                                                                      PID:7828
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,14987534961675046496,6677549038655778466,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
                                                                4⤵
                                                                  PID:4976
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,17462525119899062599,5499501793529277316,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
                                                                  4⤵
                                                                    PID:6132
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,17105855675563474361,9695931342239007864,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
                                                                    4⤵
                                                                      PID:5224
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,2377704801840833579,13149463500699389390,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
                                                                      4⤵
                                                                        PID:6764
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,17492435485518174883,3285296885766816168,524288 --field-trial-handle=2892,i,3105462538090699755,11900398725944124357,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
                                                                        4⤵
                                                                          PID:6388
                                                                      • C:\Windows\System32\WScript.exe
                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
                                                                        3⤵
                                                                          PID:5100
                                                                        • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
                                                                          "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe" -stat 92
                                                                          3⤵
                                                                          • Adds policy Run key to start application
                                                                          • Executes dropped EXE
                                                                          • Adds Run key to start application
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies Control Panel
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:836
                                                                        • C:\Windows\system32\cmd.exe
                                                                          /d /c taskkill /t /f /im "sdchange.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe" > NUL
                                                                          3⤵
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6136
                                                                          • C:\Windows\system32\taskkill.exe
                                                                            taskkill /t /f /im "sdchange.exe"
                                                                            4⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5192
                                                                          • C:\Windows\system32\PING.EXE
                                                                            ping -n 1 127.0.0.1
                                                                            4⤵
                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                            • Runs ping.exe
                                                                            PID:5264
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /d /c taskkill /t /f /im "e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe" > NUL
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • System Network Configuration Discovery: Internet Connection Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5028
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill /t /f /im "e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16.exe"
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Kills process with taskkill
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4588
                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                          ping -n 1 127.0.0.1
                                                                          3⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                          • Runs ping.exe
                                                                          PID:4540
                                                                    • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
                                                                      "C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe"
                                                                      1⤵
                                                                      • Adds policy Run key to start application
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies Control Panel
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2332
                                                                    • C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
                                                                      C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
                                                                      1⤵
                                                                      • Adds policy Run key to start application
                                                                      • Executes dropped EXE
                                                                      • Adds Run key to start application
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies Control Panel
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2508
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                      1⤵
                                                                        PID:4936
                                                                      • C:\Windows\system32\AUDIODG.EXE
                                                                        C:\Windows\system32\AUDIODG.EXE 0x4f8 0x500
                                                                        1⤵
                                                                          PID:1268
                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                          1⤵
                                                                            PID:5040
                                                                          • C:\Windows\System32\WaaSMedicAgent.exe
                                                                            C:\Windows\System32\WaaSMedicAgent.exe d939a020dcad0be44b3186ac7df5673e uK8DYOcmt0K4qt0D1CoCEg.0.1.0.0.0
                                                                            1⤵
                                                                              PID:4580

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  manifest.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1263042750\manifest.json
                                                                                  • Size 43B
                                                                                  • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1655771252\manifest.json
                                                                                  • Size 135B
                                                                                  • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  manifest.json
                                                                                  • Path C:\Program Files\chrome_Unpacker_BeginUnzipping2288_1737842109\manifest.json
                                                                                  • Size 160B
                                                                                  • SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  f56569e9-97e3-4fe4-95ff-74117c5042e4.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\f56569e9-97e3-4fe4-95ff-74117c5042e4.tmp
                                                                                  • Size 105KB
                                                                                  • SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  protocols.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                  • Size 3KB
                                                                                  • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  CrashpadMetrics-active.pma
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
                                                                                  • Size 16KB
                                                                                  • SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 2b7f070a4d3175a30ab1f73e5c86d8af917125a0b9ba72da395511cdb1d406c6
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  settings.dat
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                  • Size 280B
                                                                                  • SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  BookmarkMergedSurfaceOrdering
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                  • Size 6B
                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  the-real-index
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                  • Size 3KB
                                                                                  • SHA256 e94cf0121283fe35cfded7bb09ef493dd047df4cbe5d4e366e68a1339c0a88f2
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  the-real-index~RFe5910cf.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5910cf.TMP
                                                                                  • Size 3KB
                                                                                  • SHA256 04f16afa0bc4365084fb4f713a8e57116088b78c0bca2d41ff648db61ba1bf1f
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data_1
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                  • Size 264KB
                                                                                  • SHA256 7190ab6d63abe48a2f8a7be3019d04a05eedf3d61d9a54be0a6d7c70ece767ac
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  SiteList-Enterprise.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                  • Size 2B
                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  HubApps
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                  • Size 106KB
                                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                  • Size 2KB
                                                                                  • SHA256 f3658708360c525b781753edbaab303042da184866ac2a74259a252bcf9354e6
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                  • Size 2KB
                                                                                  • SHA256 ab597210d5424b83410f6cba6b580fbfa84b4676501de66497e61392ed9c0cc1
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Network Persistent State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                  • Size 111B
                                                                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  SCT Auditing Pending Reports
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                  • Size 2B
                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 13KB
                                                                                  • SHA256 e3cedf52821d326eaa0a7090c11bcc437cc1269762cdbb78b3593ad593c8485e
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 14KB
                                                                                  • SHA256 3dd1333ef79033334ba62896a35c7a7e048c9bbb76e24ce0ebbd3dbdb8088a8c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 13KB
                                                                                  • SHA256 f7b23a8b262eb409ae702c167ea591cecab9ce7a203bac7ed1effe55d0f6b8ac
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                  • Size 14KB
                                                                                  • SHA256 921b52596eb7d5340be825be2973b586d7cc7bbd3f091abbbc2b9588b4412663
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Secure Preferences
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                  • Size 35KB
                                                                                  • SHA256 b21db3f8e379ca94213ec137c3217638ff18fc1f527cf54f9b9ad8ab9bb54473
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sync_diagnostic.log
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                  • Size 4KB
                                                                                  • SHA256 35d4db8be7d9cd74626cadadd53ce788aee23e9e592b7757b3f267580a6ce286
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  e3532fce-811c-45e8-af62-0c343e4ec5d3.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e3532fce-811c-45e8-af62-0c343e4ec5d3.tmp
                                                                                  • Size 70KB
                                                                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  OperationConfig
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                  • Size 22KB
                                                                                  • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  OperationConfig~RFe595a4b.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595a4b.TMP
                                                                                  • Size 3KB
                                                                                  • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 25KB
                                                                                  • SHA256 dfaf3ff4ebc3cc1973d6ef4a0fd5caa2491458c8ef9a2b1cbfc101e0a6850efb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 15KB
                                                                                  • SHA256 5eb4a180ab978eb879f1fcc6eed3413d3f191502215d19988c773431a2e80d44
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 32KB
                                                                                  • SHA256 ace8c8ec206615b18e1799d0c55f5638b16489b78e92931bb1cc553defa8cf69
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 15KB
                                                                                  • SHA256 ccb616cf30ff6f542e4713211303e088e3788fd9801e0c272ecad03d85063b7f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 8KB
                                                                                  • SHA256 6525e03a5eb333f4513f2a84d7137b43cb3c0977057717f8e20fedf3326fbe25
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 15KB
                                                                                  • SHA256 dfd74c2f82e0c44035a52429bf6ea2bb3dfa547ede48213a68314c9fee535cbc
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 25KB
                                                                                  • SHA256 7e3a1b5cca2df15123d9ec9efa09535ae2d0ee67c2c4aff93e0cf0b6e3d34dc0
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 15KB
                                                                                  • SHA256 67c90dd884f149b2d15d2288fa86d141f88642d495866cee858c3ea3e20cd646
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 9KB
                                                                                  • SHA256 dfe0dc4359a9e8f2bde9b135864b3d9ace8c4ce4304873e57c4424ab0bc8be90
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Local State
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                  • Size 25KB
                                                                                  • SHA256 3affdaa143ab4935aef09e30e97f297d4bbcf5549302fce54490d5789638cd99
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  RevisitationBloomfilter
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                  • Size 392B
                                                                                  • SHA256 b7cbb37c5a797f65fc78e4e3ebc761f601f3821397fa29422289f5daaf587bf7
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  RevisitationBloomfilter~RFe58d685.TMP
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d685.TMP
                                                                                  • Size 392B
                                                                                  • SHA256 dd0fa5adacf14ab2a4c5ce92eb7abee9491d80892e564644ab2058edbfa5121f
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  nav_config.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
                                                                                  • Size 2KB
                                                                                  • SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  metadata.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                  • Size 252B
                                                                                  • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  metadata.json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                  • Size 132B
                                                                                  • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  5562b45f-3144-4a74-8766-5b3a37fe29af.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5562b45f-3144-4a74-8766-5b3a37fe29af.tmp
                                                                                  • Size 13B
                                                                                  • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                  • Size 2KB
                                                                                  • SHA256 4693ca74b90224d33222394df886b9c6f21cca81acf4d6918ff8ae4693238975
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  json[1].json
                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\json[1].json
                                                                                  • Size 251B
                                                                                  • SHA256 74fade3c25a3eb1081be9607147e3e0817ba9bb3094670b51a975be7c21725e2
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  0fe9ad3d-d43b-45ec-926a-cac6766b697a.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\0fe9ad3d-d43b-45ec-926a-cac6766b697a.tmp
                                                                                  • Size 10KB
                                                                                  • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  e1fbcac4-f388-43f6-aeb1-390689ccd3c9.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\e1fbcac4-f388-43f6-aeb1-390689ccd3c9.tmp
                                                                                  • Size 1B
                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                  • MD5 SHA1 SHA512
                                                                                  Submit Download

                                                                                  LangDLL.dll
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsy46.tmp\LangDLL.dll
                                                                                  • Size 7KB
                                                                                  • SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  System.dll
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsy46.tmp\System.dll
                                                                                  • Size 23KB
                                                                                  • SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  nsDialogs.dll
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\nsy46.tmp\nsDialogs.dll
                                                                                  • Size 13KB
                                                                                  • SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  content_new.js
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2288_2047004089\CRX_INSTALL\content_new.js
                                                                                  • Size 10KB
                                                                                  • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  94fc4409-1c53-4b71-bd3a-aeffbd1e6747.tmp
                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2288_828258485\94fc4409-1c53-4b71-bd3a-aeffbd1e6747.tmp
                                                                                  • Size 152KB
                                                                                  • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  sdchange.lnk
                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\sdchange.lnk
                                                                                  • Size 1KB
                                                                                  • SHA256 f0c729e6d050a90b6341d3b4dfbb1c3d6dcfe8b255023ba7e98e5ea1d990b809
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  sdchange.exe
                                                                                  • Path C:\Users\Admin\AppData\Roaming\{9E4640F1-3E4A-20DA-9F9B-9C3CCF093F74}\sdchange.exe
                                                                                  • Size 112KB
                                                                                  • SHA256 e8c6741d3d21068535fb6bb7fe676ecaa74eee06a655c7aa915fc39c0ee7ee16
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  CrjXKZZqxk.cerber
                                                                                  • Path C:\Users\Admin\Desktop\CrjXKZZqxk.cerber
                                                                                  • Size 316KB
                                                                                  • SHA256 21c094ba1a7e8bdf45db984033aa916248c504a246a6e976d57c5936d6b307c6
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  ETu9kD0zAq.cerber
                                                                                  • Path C:\Users\Admin\Desktop\ETu9kD0zAq.cerber
                                                                                  • Size 287KB
                                                                                  • SHA256 cce24df405e3c5d6d844230a306107b92131de33cd526771a3581f605e9c4d6b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Fao3BIbi3B.cerber
                                                                                  • Path C:\Users\Admin\Desktop\Fao3BIbi3B.cerber
                                                                                  • Size 11KB
                                                                                  • SHA256 63803dcee2879d0df6489c700a395ef8c70c8f9c8b079cca27e7b56818da5ea5
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  IHAIwEPTW8.cerber
                                                                                  • Path C:\Users\Admin\Desktop\IHAIwEPTW8.cerber
                                                                                  • Size 346KB
                                                                                  • SHA256 76160038d6dd66ea3d37f58227427803e9675a52006eb4f93c9211658249c434
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  JaYrtpVywe.cerber
                                                                                  • Path C:\Users\Admin\Desktop\JaYrtpVywe.cerber
                                                                                  • Size 239KB
                                                                                  • SHA256 b8b67603aaeb39827cf8653bdee8742c82394694ed7255642b30260e60ccf52c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  KTR8t5E0bR.cerber
                                                                                  • Path C:\Users\Admin\Desktop\KTR8t5E0bR.cerber
                                                                                  • Size 13KB
                                                                                  • SHA256 a6402f4b3c9c9a41e4e1562cf4b060ac0f443b925aaf0d1bad84b8bc2caaa18b
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  KnjYoMd6XI.cerber
                                                                                  • Path C:\Users\Admin\Desktop\KnjYoMd6XI.cerber
                                                                                  • Size 200KB
                                                                                  • SHA256 2c920b1d2014d4397d097b83fd8e6679092eb1355a288b6fc8f8453a1124cba4
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  LPxP9ZHJli.cerber
                                                                                  • Path C:\Users\Admin\Desktop\LPxP9ZHJli.cerber
                                                                                  • Size 14KB
                                                                                  • SHA256 dd2ffabf70f3f3a8c39ac490b7063e14bb312cef13739ac6eafd3f1cc4f7a0b7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  MEYOkJ_IXp.cerber
                                                                                  • Path C:\Users\Admin\Desktop\MEYOkJ_IXp.cerber
                                                                                  • Size 180KB
                                                                                  • SHA256 782496efb58978e9479f7f7c7cf92ca44500043682874aa5e4a69685e87df25c
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  data.safe.bin
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
                                                                                  • Size 82B
                                                                                  • SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 82B
                                                                                  • SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 82B
                                                                                  • SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 82B
                                                                                  • SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 140B
                                                                                  • SHA256 48cd83f0a9f8a14fd4e18d1ca46569e41bd49dcf7b4b621cea208dfba5615a89
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 82B
                                                                                  • SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  data.safe.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                  • Size 82B
                                                                                  • SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  extensions.json
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
                                                                                  • Size 17KB
                                                                                  • SHA256 f24cd476ac97879ab77d85f46d9dbd164a35852fb9f45324cb6eb07d529fe30a
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  prefs-1.js
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                  • Size 5KB
                                                                                  • SHA256 e197c97d1c58e7ca50fb66215df86312244dbd2fcd2b3427c1bfe62b276e76e9
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  prefs-1.js
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                  • Size 4KB
                                                                                  • SHA256 c7ee0453c32af978f78dde4ed5e0ed01bf3654504ceea7011b4576a630d8dd22
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  prefs.js
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                  • Size 4KB
                                                                                  • SHA256 1327dd4d20061cbc9fa04381e4e1ca37eabe76b9878234e16f43eab33a4c6f19
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  prefs.js
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                  • Size 1KB
                                                                                  • SHA256 8ccb62c4fc03a3139da88b924fde6cb4c16bb2df81bdd95825439998e354b8d5
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  3870112724rsegmnoittet-es.sqlite
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                  • Size 120KB
                                                                                  • SHA256 7cd61c1c8d47713af386aa81a3ff5eacccbb6f3b492a1929e1e9296356ea6925
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  cached-certs
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-certs
                                                                                  • Size 20KB
                                                                                  • SHA256 3bbe975b208115f4f4f3d0785466faba5833bd81ec20844b891a1ed7c4e2bdf2
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  cached-microdesc-consensus.tmp
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
                                                                                  • Size 3.3MB
                                                                                  • SHA256 7c64fe5ce19b849df215cf3af7c68c9a7014ef72cc17c55e9ddf6243e94b6665
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  cached-microdescs.new
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
                                                                                  • Size 13.7MB
                                                                                  • SHA256 13322554a203db81166dc42fb3ee72466222be704702be2f23423a5cfc661fed
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  firefox.exe
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                  • Size 1.7MB
                                                                                  • SHA256 241366fae863e43e7a046b66c820c12771f030b6b4590cf5fb2646a4f44de074
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  mozglue.dll
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
                                                                                  • Size 975KB
                                                                                  • SHA256 de4a5fdf5cc1a516b578e2936337e6adaeae203f5ff5a78f44303ec6799c9b52
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  Tor Browser.lnk
                                                                                  • Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                                                  • Size 829B
                                                                                  • SHA256 837d1282adc0eea7685128d4466e601d941bb97d0942de031a35eee90946b261
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  bLPRMt6-5J.cerber
                                                                                  • Path C:\Users\Admin\Desktop\bLPRMt6-5J.cerber
                                                                                  • Size 10KB
                                                                                  • SHA256 d75d230fa8d1c59e1633eacc6d600b4c733c5b8b964cbfedb145f9092ff090e7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  bR6FiJCLyL.cerber
                                                                                  • Path C:\Users\Admin\Desktop\bR6FiJCLyL.cerber
                                                                                  • Size 151KB
                                                                                  • SHA256 6b090a4587968e7efb8daecb2030fe56ee4013094ab7de0120b8e65517066bdd
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  bY1DlRaMVA.cerber
                                                                                  • Path C:\Users\Admin\Desktop\bY1DlRaMVA.cerber
                                                                                  • Size 355KB
                                                                                  • SHA256 87d0fca2d7d0739fdb86d42b86f08ca08f05951941cade23550a3b0d4940e829
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  fHXEkZ-Nwy.cerber
                                                                                  • Path C:\Users\Admin\Desktop\fHXEkZ-Nwy.cerber
                                                                                  • Size 336KB
                                                                                  • SHA256 bf44a74cefa215841ec9ff1ab1f283c6b11e16ddb8bfd6d2cb34fe17305f8e2f
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  jTQm60Ov38.cerber
                                                                                  • Path C:\Users\Admin\Desktop\jTQm60Ov38.cerber
                                                                                  • Size 16KB
                                                                                  • SHA256 3b30f856d8e01000bd7c47cc73f01cfbca2d892423f24e0382db9f45e2c666f7
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  # DECRYPT MY FILES #.vbs
                                                                                  • Path C:\Users\Admin\Downloads\# DECRYPT MY FILES #.vbs
                                                                                  • Size 203B
                                                                                  • SHA256 020ca4b4574a40418b8aa4c2d74b0488e9d150e8d3f5e56e5c6dcca6f7dfaaac
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  # DECRYPT MY FILES #.html
                                                                                  • Path C:\Users\Default\# DECRYPT MY FILES #.html
                                                                                  • Size 1KB
                                                                                  • SHA256 b8c5e4c89fede25c3c0fc4dac41899b3d8c271bfa73d13b37608798e59dfc77b
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  # DECRYPT MY FILES #.txt
                                                                                  • Path C:\Users\Default\# DECRYPT MY FILES #.txt
                                                                                  • Size 750B
                                                                                  • SHA256 fee0f2e388e64011383a61cad06d8969115356005bb21f75cfe75ff93d47a84a
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  memory/2208-1920-0x0000013AD9600000-0x0000013AD9955000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1254-0x00007FF949CE0000-0x00007FF949CE1000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1357-0x0000028130800000-0x0000028130B55000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1252-0x00007FF94AA10000-0x00007FF94AA11000-memory.dmp
                                                                                  Download

                                                                                  memory/3328-1253-0x00007FF949260000-0x00007FF949261000-memory.dmp
                                                                                  Download

                                                                                  memory/4176-1913-0x00000250E0800000-0x00000250E0B55000-memory.dmp
                                                                                  Download

                                                                                  memory/4312-1903-0x0000011214200000-0x000001121432D000-memory.dmp
                                                                                  Download

                                                                                  memory/4328-1408-0x000001F133C70000-0x000001F133C80000-memory.dmp
                                                                                  Download

                                                                                  memory/4328-1260-0x000001F1323A0000-0x000001F1323B0000-memory.dmp
                                                                                  Download

                                                                                  memory/4760-1921-0x000001668C900000-0x000001668CC55000-memory.dmp
                                                                                  Download

                                                                                  memory/5012-810-0x0000000000C70000-0x0000000000C71000-memory.dmp
                                                                                  Download

                                                                                  memory/5012-9-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
                                                                                  Download

                                                                                  memory/5256-1904-0x00000265F7F00000-0x00000265F8255000-memory.dmp
                                                                                  Download

                                                                                  memory/5276-1919-0x0000016A0CA00000-0x0000016A0CD55000-memory.dmp
                                                                                  Download

                                                                                  memory/5308-1894-0x000001D3A5100000-0x000001D3A522D000-memory.dmp
                                                                                  Download

                                                                                  memory/7488-2176-0x000001ADC4D00000-0x000001ADC5055000-memory.dmp
                                                                                  Download

                                                                                  memory/7828-2180-0x0000026495600000-0x0000026495955000-memory.dmp
                                                                                  Download

                                                                                  memory/8116-1928-0x000002D3A4E00000-0x000002D3A5155000-memory.dmp
                                                                                  Download