Overview

overview

8

Static

static

1

URLScan

urlscan

http://jsdkhsdhjkfh

windows10-2004-x64

8

Analysis

  • geolocation tags

    asiadelhiinindia
  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    640s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 16:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://jsdkhsdhjkfh
  • Sample260804-t54bdsveqa
Score
8/10
command_and_controldefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 64 IoCs
  • Outbound SSH connection to public host 2 TTPs 4 IoCs

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 48 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jsdkhsdhjkfh
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcdd16c188,0x7ffcdd16c194,0x7ffcdd16c1a0
      2⤵
        PID:1728
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,16751043268481149119,11626446698550400352,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:552
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,4620307646069481017,4430555293892563296,262144 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
        2⤵
          PID:5116
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13257437537295971130,15814851794368314495,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:512
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,16592554286180353218,1208967619459955497,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
            2⤵
              PID:3312
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11802279484298641044,6739575507216318112,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
              2⤵
                PID:3820
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,7358677545886345809,13603713618458412326,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                2⤵
                  PID:532
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,16954556954913869402,10976484193649044398,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
                  2⤵
                    PID:1692
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,11643993442363897210,14292699612229192669,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
                    2⤵
                      PID:3396
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,11868281321232630501,7771099156506607295,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
                      2⤵
                        PID:4080
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1318647346913100635,14282901286979893141,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
                        2⤵
                          PID:3932
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12124103766602153233,16965440435768501121,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
                          2⤵
                            PID:1224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12124103766602153233,16965440435768501121,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
                            2⤵
                              PID:4132
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,12846303606002086650,10128037383080624498,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
                              2⤵
                                PID:972
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,14538291657743394968,15495872102640804055,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
                                2⤵
                                  PID:3596
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,5444538946867147443,6610959232670603330,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
                                  2⤵
                                    PID:3012
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,11474429997009903229,16486116075430873991,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
                                    2⤵
                                      PID:2300
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5312,i,14737676062507056610,1961226416021009272,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
                                      2⤵
                                        PID:1980
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5628,i,14052239817016409665,12929758308893639487,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
                                        2⤵
                                          PID:2076
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,10658951302359193679,1949005627836808372,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
                                          2⤵
                                            PID:2680
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5148,i,12885333544684153079,8104255950383242658,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
                                            2⤵
                                              PID:4776
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3688,i,15087276093550170917,16605629153958542500,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:1
                                              2⤵
                                                PID:716
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5176,i,13035317087531340416,16271704683364906532,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                                                2⤵
                                                  PID:768
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5376,i,8365941227383271816,7523291308612708593,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
                                                  2⤵
                                                    PID:3588
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6592,i,1971491788663305184,4440423333565752113,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
                                                    2⤵
                                                      PID:3724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,11446110330863816847,16866046908627388256,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:8
                                                      2⤵
                                                        PID:4460
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6796,i,10273357501527221507,6336700197205298353,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
                                                        2⤵
                                                          PID:3796
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6656,i,9282989128099336408,12782986616161905681,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                                                          2⤵
                                                            PID:1060
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,2583075765402196453,11596400929792071031,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:8
                                                            2⤵
                                                              PID:2396
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7592,i,16882456736722978481,12324773209292686502,2097152 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
                                                              2⤵
                                                                PID:5028
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,11604628743915212317,11606634614928784702,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
                                                                2⤵
                                                                  PID:1984
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6124,i,2798229921852619189,3714887972562363759,262144 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4032
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,11627184193403810560,9701046557241750992,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8
                                                                  2⤵
                                                                    PID:764
                                                                  • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe
                                                                    "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe"
                                                                    2⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Modifies registry class
                                                                    PID:4728
                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:2580
                                                                      • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                        4⤵
                                                                        • Checks computer location settings
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Checks whether UAC is enabled
                                                                        • Checks system information in the registry
                                                                        • Checks processor information in registry
                                                                        • Modifies registry class
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1160
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -prefsHandle 2680:26451 -prefMapHandle 2684:276441 -ipcHandle 2704 -initialChannelId {161d2eca-b7e8-454a-b208-5cf9f79d1d09} -parentPid 1160 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:4636
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 1716:27031 -prefMapHandle 1924:276441 -jsInitHandle 2436:242832 -parentBuildID 20260720080000 -ipcHandle 2176 -initialChannelId {042e9046-7cfc-4c84-b107-35af88eefbfa} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:4836
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -prefsHandle 1968:27718 -prefMapHandle 1828:276441 -ipcHandle 1952 -initialChannelId {e8c1bef3-a7b1-471b-a600-8d7e3d85d760} -parentPid 1160 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:4796
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:54a9150986710964604860e406af0a10a224b992fbd89d50b5c19375db +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1160 DisableNetwork 1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:1072
                                                                          • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                            TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Outbound SSH connection to public host
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:6540
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3356:27780 -prefMapHandle 3360:276441 -jsInitHandle 3364:242832 -parentBuildID 20260720080000 -ipcHandle 3324 -initialChannelId {32f2d487-42b8-4959-88f7-84d8f4467eb1} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:5032
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3216:27856 -prefMapHandle 3080:276441 -jsInitHandle 3204:242832 -parentBuildID 20260720080000 -ipcHandle 3148 -initialChannelId {822ca0d5-c7c2-4443-bc69-259421b8a41f} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:5184
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -sandboxingKind 0 -prefsHandle 3972:29674 -prefMapHandle 3976:276441 -ipcHandle 3984 -initialChannelId {d11c4485-5459-4b49-ad1f-f74c8b2ff5b8} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 utility
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:5960
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4172:28722 -prefMapHandle 4136:276441 -jsInitHandle 4240:242832 -parentBuildID 20260720080000 -ipcHandle 4248 -initialChannelId {6ba02580-509b-4e23-9a16-3bdae8a69abc} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Checks processor information in registry
                                                                          PID:6416
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4404:28722 -prefMapHandle 4420:276441 -jsInitHandle 4424:242832 -parentBuildID 20260720080000 -ipcHandle 4436 -initialChannelId {3a0ae541-bb8e-48ea-acd2-05fdf0a9dfc5} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:6760
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4612:28722 -prefMapHandle 4616:276441 -jsInitHandle 4620:242832 -parentBuildID 20260720080000 -ipcHandle 4628 -initialChannelId {88da6363-27bf-413b-9ed5-70f189b200bf} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Checks processor information in registry
                                                                          PID:7164
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4816:28722 -prefMapHandle 4820:276441 -jsInitHandle 4824:242832 -parentBuildID 20260720080000 -ipcHandle 4832 -initialChannelId {1024cdec-e8f2-4605-b9e8-66f84034c69d} -parentPid 1160 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Checks processor information in registry
                                                                          PID:7268
                                                                        • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                          "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies trusted root certificate store through registry
                                                                          • Modifies system certificate store
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:6412
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,12352263455532347416,18053694973932095875,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
                                                                    2⤵
                                                                      PID:5984
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,8424927658981849241,6374323503192637910,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
                                                                      2⤵
                                                                        PID:6008
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2373105971268219068,1823941486751972825,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
                                                                        2⤵
                                                                          PID:5664
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,9813614774429319292,1491800826798704368,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8
                                                                          2⤵
                                                                            PID:7136
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7200,i,17262199262250832404,4730517686916496188,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
                                                                            2⤵
                                                                              PID:7724
                                                                            • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe
                                                                              "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe"
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:2136
                                                                            • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe
                                                                              "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe"
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:204
                                                                            • C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe
                                                                              "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.19.exe"
                                                                              2⤵
                                                                              • Checks computer location settings
                                                                              • Executes dropped EXE
                                                                              • Modifies registry class
                                                                              PID:4808
                                                                              • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:2660
                                                                                • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                  "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
                                                                                  4⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Checks whether UAC is enabled
                                                                                  • Checks system information in the registry
                                                                                  • Checks processor information in registry
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1848
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -prefsHandle 2184:28380 -prefMapHandle 2188:278188 -ipcHandle 2220 -initialChannelId {e8931702-ddb4-470b-a49e-45a1f301b366} -parentPid 1848 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:7096
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:d2fa269fa726aad260fc821c45f2701ae7e1b1c160e96dc624af2396e4 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1848 DisableNetwork 1
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5924
                                                                                    • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                                      TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies system certificate store
                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                      PID:5356
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3056:28492 -prefMapHandle 3060:278188 -jsInitHandle 3064:242832 -parentBuildID 20260720080000 -ipcHandle 3076 -initialChannelId {54ab8d3d-a262-4e66-8e44-2efbfae43730} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:3276
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -prefsHandle 3280:28492 -prefMapHandle 3284:278188 -ipcHandle 3352 -initialChannelId {55996d63-993a-488e-88f3-2b8bad6e3a21} -parentPid 1848 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2496
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2676:28581 -prefMapHandle 2044:278188 -jsInitHandle 2772:242832 -parentBuildID 20260720080000 -ipcHandle 2884 -initialChannelId {59cefc5d-1f30-4b87-9977-a65838ef45b4} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:7480
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260720080000 -sandboxingKind 0 -prefsHandle 3764:28622 -prefMapHandle 3756:278188 -ipcHandle 3784 -initialChannelId {982ec58e-ae81-424d-9aef-47c68d674e95} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 utility
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:1296
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3980:27341 -prefMapHandle 3984:278188 -jsInitHandle 3988:242832 -parentBuildID 20260720080000 -ipcHandle 3908 -initialChannelId {b515956c-ae5b-433c-977a-10d095848635} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:8064
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4080:27489 -prefMapHandle 4076:278188 -jsInitHandle 4008:242832 -parentBuildID 20260720080000 -ipcHandle 4180 -initialChannelId {421e5448-92b9-4085-a4f0-a95799dd6410} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:6464
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4424:27489 -prefMapHandle 4428:278188 -jsInitHandle 4432:242832 -parentBuildID 20260720080000 -ipcHandle 2652 -initialChannelId {7cf66400-4cee-49d7-873c-e7fcfda3b98a} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
                                                                                    5⤵
                                                                                    • Checks computer location settings
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:6452
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4636:27489 -prefMapHandle 4640:278188 -jsInitHandle 4644:242832 -parentBuildID 20260720080000 -ipcHandle 4428 -initialChannelId {8c27de3f-1da2-4721-83ed-5fab12d38543} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:6612
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\PluggableTransports\lyrebird.exe"
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:8072
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4072:27574 -prefMapHandle 4800:278188 -jsInitHandle 4408:242832 -parentBuildID 20260720080000 -ipcHandle 4892 -initialChannelId {b24b882c-7eb2-4e48-bafa-77e6282effdf} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:5960
                                                                                  • C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3988:27693 -prefMapHandle 4264:278188 -jsInitHandle 4356:242832 -parentBuildID 20260720080000 -ipcHandle 3612 -initialChannelId {a73f5aca-450c-45c1-956c-ec531102378e} -parentPid 1848 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks processor information in registry
                                                                                    PID:6156
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,11586712233981813073,9871106840596011689,524288 --field-trial-handle=2284,i,3127087909785488644,14954671525828974657,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
                                                                              2⤵
                                                                                PID:4620
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                              1⤵
                                                                                PID:3388

                                                                              Network

                                                                                    MITRE ATT&CK Enterprise v16

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    blocklist
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                    • Size 105KB
                                                                                    • SHA256 416537d5becea53a7c07d47e3d22673cb50daabf00e6e0967f57baef645377f1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    settings.dat
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                    • Size 280B
                                                                                    • SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    73461759-0612-4bc2-a7ee-1af85d330d0a.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73461759-0612-4bc2-a7ee-1af85d330d0a.tmp
                                                                                    • Size 13KB
                                                                                    • SHA256 7875464fee2a43fc28964f79dd73f96bce4038639e896ba15a608f93fbbef4de
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    LOG.old
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                    • Size 352B
                                                                                    • SHA256 acebfd34e5abb122496d1445315ade62a16d296b92555d6997200d6f30f64004
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    LOG.old
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                    • Size 331B
                                                                                    • SHA256 e66eb6cdba1a60ed70036f1471b6a7be787c6fd0b34ffce22c782a89a35759a2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    LOG.old
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                    • Size 331B
                                                                                    • SHA256 512066fea74fc45104c2a42d22988c62a6c3035c3e3cacb5862c032dd0a18ca6
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    LOG.old
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                    • Size 334B
                                                                                    • SHA256 af34ceb4b83e69761b808eeaa80b943deb0270c86facd4811d0331cc5e6127b0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    MANIFEST-000001
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                    • Size 158B
                                                                                    • SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    BookmarkMergedSurfaceOrdering
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                    • Size 6B
                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    f_00008f
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
                                                                                    • Size 32KB
                                                                                    • SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000090
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
                                                                                    • Size 96KB
                                                                                    • SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000091
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                                    • Size 67KB
                                                                                    • SHA256 25b05fb02fedfc6cce6cbb542030d8ab4e66c10b4d7ed8f3f309e7fea4ac9963
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000092
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                                    • Size 405KB
                                                                                    • SHA256 bb90ac8097da7c793676be5885f5cf00b9e5a27e30a878296c59d1b4ba27bb62
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000094
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
                                                                                    • Size 27KB
                                                                                    • SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    f_000095
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
                                                                                    • Size 78KB
                                                                                    • SHA256 be18ee476965bd3081ebb3f7993f6a6712d9a69fbe4d3b0adf8c7306cc21e124
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 7KB
                                                                                    • SHA256 11513a1d815f7485a9d349c6518806302948edaf44527518c720066eaeb70946
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                    • Size 3KB
                                                                                    • SHA256 4925c800204ce1269f7f15155ce476ce1078c0b24dc6a85f03d159efbb75aa01
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe585f51.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585f51.TMP
                                                                                    • Size 3KB
                                                                                    • SHA256 83226feb09451983a9d54abd9680ea7f7ab81e516add9b2805996db7814c4eb7
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    SiteList-Enterprise.json
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                    • Size 2B
                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Edge Profile.ico
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                    • Size 70KB
                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 5KB
                                                                                    • SHA256 01b4723ae17773a365d52dc9a2e74ccf9a7498a876ec9b602b3fc8e1bc9e208c
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 3KB
                                                                                    • SHA256 315c4bd759ab16af791241f02536868bcd8498e2c10d999db534bbd663711b86
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 3KB
                                                                                    • SHA256 e138bb9621d7c2a5b371afcc0a37ed44b6d88a06b2f776522e72722799755ef0
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 111B
                                                                                    • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Network Persistent State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                    • Size 4KB
                                                                                    • SHA256 e321b537b291b6db968ce98ff998062b229cfd900c470a712781da92cd5074ae
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    SCT Auditing Pending Reports
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                    • Size 2B
                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Sdch Dictionaries
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                    • Size 211B
                                                                                    • SHA256 476296d275d394faad09b1eee8be23da156f224e84a39d65bad251c7ef2420a1
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Sdch Dictionaries~RFe5918ed.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5918ed.TMP
                                                                                    • Size 40B
                                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 12KB
                                                                                    • SHA256 0018de0a048f51fb3bb71d11b3391b5621d2dbde5d64301bac0baff116f71ddc
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 18KB
                                                                                    • SHA256 87085bcb1d7d796bec42604d328b32abb43c9cf3e29296bf85eb2151a1178829
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 18KB
                                                                                    • SHA256 3f0aa984929ae2237161d60a8460fb28f2f0dad797430562dd1f0ea810c88a35
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                    • Size 17KB
                                                                                    • SHA256 e15dafbf4a8220582d6c011877f0dfea4751430468dd054b0b8b6ad0d114cc08
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Secure Preferences
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                    • Size 30KB
                                                                                    • SHA256 d6b1134477d0158f2654ebc0d1fd81148b682c4c4c0a8381efbbf982a5841172
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
                                                                                    • Size 3KB
                                                                                    • SHA256 5022dc61a3af3050dffc7e6503a926d9ebd65b039ce0f027d67e862b4cbcebc2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
                                                                                    • Size 1KB
                                                                                    • SHA256 92037b873e469ec834b4d0a886b5c4b36214501fc14c39fdc2f0d174637e7597
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe58ad42.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe58ad42.TMP
                                                                                    • Size 1KB
                                                                                    • SHA256 8b97d3293546688bca9f4b740e8d179bcc9423a54ab3c9046627a4760cd0a9c4
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    index.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                    • Size 371B
                                                                                    • SHA256 d9d03f052def86452bcd0445dab8d689cb9a0ace5ca86697ab68df86829a9813
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    index.txt
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                    • Size 371B
                                                                                    • SHA256 99691a7437dd2ccf5d6e750e8282bf3ffb7836b5c5c6bad0d5aae8c40dc551e1
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                    • Size 72B
                                                                                    • SHA256 cdca02e488b2dff81ef1cd3523e3378701e494db7c1f8e08956dfc334cd135d9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    the-real-index~RFe598246.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598246.TMP
                                                                                    • Size 48B
                                                                                    • SHA256 621ac1305ba20a71ee376a30eba62fc878c1038890b62592d60b249a05a17697
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    sync_diagnostic.log
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                    • Size 6KB
                                                                                    • SHA256 1118d3534a82bb5fdd467c1cac870a2a1b9f07e955f69f37b16fc18acfdeddb6
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    OperationConfig
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                    • Size 22KB
                                                                                    • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    OperationConfig~RFe5904c9.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5904c9.TMP
                                                                                    • Size 3KB
                                                                                    • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 19KB
                                                                                    • SHA256 bf58dd6c51ce23056fe382516a7f2ccf6dd883e746b9afa0c50ca0b66a77bd23
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 27KB
                                                                                    • SHA256 0a2f6266f67bf107d39fa14c8bd132dfcab6447243ea2254a49ddf89f5284b69
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 8KB
                                                                                    • SHA256 08a010863cfb374b6021c6c23191758cf2711ffd78a94b22d771fc2d45cc3370
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 27KB
                                                                                    • SHA256 c6ca8f999642c5f4f276a3ae59ed02c6c1ef3f22aec024c5e1b820bfdc5e0b32
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 8KB
                                                                                    • SHA256 2033cc7e69f28d77f2f8dcd1ba9e929161884d982aa57d39e1d990b859c863ff
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 27KB
                                                                                    • SHA256 998d4100004e6f41d2b27c185153f639daa0506f3035d8a79c5582a9c60d0cd5
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 27KB
                                                                                    • SHA256 cf770138901a63d44b4ee2e69da9ad83bc3a426f23aa243538b57a44f200208d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 20KB
                                                                                    • SHA256 a62b1a235f81e43a676286ca6c3695fcb08078a43093ec895f957ba7ac8dfeba
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Local State
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                    • Size 27KB
                                                                                    • SHA256 eeee1de7a5230e010815e88c0b69174a92ddc6e2dfb5100154262fb21b9b0a18
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    RevisitationBloomfilter
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                    • Size 392B
                                                                                    • SHA256 df62ceaaa31e6d26962a479773465519a8144a5f9dba762b6ed353ec9293664f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    RevisitationBloomfilter
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                    • Size 392B
                                                                                    • SHA256 8d46dfe7528c37b4a38fd21016d52403b997c89c6bcb7a8a961a216da09594dd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    RevisitationBloomfilter~RFe590083.TMP
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590083.TMP
                                                                                    • Size 392B
                                                                                    • SHA256 11c1252a8afa1e6028ffc642f68333f374a001d97e4c07d6837d78854cad6caf
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    d0ef7a28-886b-47e0-8ed3-34f5fa230c8e.tmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d0ef7a28-886b-47e0-8ed3-34f5fa230c8e.tmp
                                                                                    • Size 13B
                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                    • MD5 SHA1 SHA512
                                                                                    Submit Download

                                                                                    5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                                                    • Size 2KB
                                                                                    • SHA256 77a12b4b4ce125e7c4dd9cd4b7b40a2153f9420332e6dcc24463696273f0dcde
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    modern-wizard.bmp
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nshB29B.tmp\modern-wizard.bmp
                                                                                    • Size 25KB
                                                                                    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    LangDLL.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsy9A8.tmp\LangDLL.dll
                                                                                    • Size 7KB
                                                                                    • SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    System.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsy9A8.tmp\System.dll
                                                                                    • Size 23KB
                                                                                    • SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    nsDialogs.dll
                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\nsy9A8.tmp\nsDialogs.dll
                                                                                    • Size 13KB
                                                                                    • SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    bookmarks-2026-08-04_14_4D8NZ17Jd9JBGgcZlHwri3NQxLZn3vw2xl09z1DX4So=.jsonlz4
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\bookmarkbackups\bookmarks-2026-08-04_14_4D8NZ17Jd9JBGgcZlHwri3NQxLZn3vw2xl09z1DX4So=.jsonlz4
                                                                                    • Size 1KB
                                                                                    • SHA256 c3c53c64ebe4dbd24798e17571212910f77f2e10fc64570f062bcfcfba6d7eef
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    broadcast-listeners.json
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\broadcast-listeners.json
                                                                                    • Size 209B
                                                                                    • SHA256 63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.bin
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
                                                                                    • Size 82B
                                                                                    • SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.bin
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
                                                                                    • Size 984B
                                                                                    • SHA256 639a98d9ddc3e2d4e088f67efe723849254938b9810a2af621f7ad517fa40286
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 82B
                                                                                    • SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 82B
                                                                                    • SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 82B
                                                                                    • SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 140B
                                                                                    • SHA256 48cd83f0a9f8a14fd4e18d1ca46569e41bd49dcf7b4b621cea208dfba5615a89
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 82B
                                                                                    • SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 82B
                                                                                    • SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 1KB
                                                                                    • SHA256 cc075004dcc63f72e53c83e119ba3f7590e4cde714810af3acd8e90fe14c4072
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 984B
                                                                                    • SHA256 f642ccfb7a6d17449fe8283406f9d475dc8b3d426392236264f33221feeae7b9
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 984B
                                                                                    • SHA256 eff656d819521d772159abf4ab5e6bc19eedcb788f3d9a4fd8ded12d0a94d475
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 984B
                                                                                    • SHA256 bdd4ac661d14f59cd3d0af0c02ba7d82d54ba28ce176820fdfc3c4a05c26e514
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 984B
                                                                                    • SHA256 eb54d69b8ac9eb276fd69add5ad4257e3fe9d50ea58bcc7abe0511fd6bf8ba7f
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    data.safe.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
                                                                                    • Size 984B
                                                                                    • SHA256 94e0f7da19248c8ccc62d628a489f1b30a028d10b0252ad2bf1081cb3e56c817
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    extensions.json
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
                                                                                    • Size 17KB
                                                                                    • SHA256 cc9814094a5c102c998d49609e4dd935975bd7616368206fbf6a40d2dd695e97
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 5KB
                                                                                    • SHA256 6f26d295da13246b08692daf7f26a3556da5d32a1f0db56d9c6bd4aaec7bac29
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 5KB
                                                                                    • SHA256 5b79cf35ebd6e9599a9a637532678b3f351ac19ceda9780f39f166e9bb035950
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 4KB
                                                                                    • SHA256 96ec2bf424956242f74cf5fa92ff220817942af5443cf621babc2717941beca1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 5KB
                                                                                    • SHA256 7d8048bbac431bf28b7358379192943f425be45cc2778b429fbef5cbc4dec309
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 4KB
                                                                                    • SHA256 e1112186accd43e6552c69337a42475feda32940d974e8dc5f400e81c277c281
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs-1.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
                                                                                    • Size 6KB
                                                                                    • SHA256 9f9ebd93ca384ac4e99a9d0e8ef14bad066f33a311c8425e3bb97fb16a4deacd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                    • Size 1KB
                                                                                    • SHA256 80d3826ff3c6d53dc01e65f700897dd50e9930b6a6d74b5a8ead3516ca8db1bd
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    prefs.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                    • Size 2KB
                                                                                    • SHA256 fd793657443846f201e879d766c263a2b83c81aa77bbff438bf652b42976639c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    prefs.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                    • Size 4KB
                                                                                    • SHA256 53a26728dd8f740d4952ba46cc1e533ebfe4d123502651b4a0c01a18563cfe57
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    prefs.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
                                                                                    • Size 6KB
                                                                                    • SHA256 a1d1703b4329010b96a9aecf4c22b705e1c1949123f3933b06e40bddca8e8645
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    sessionCheckpoints.json
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json
                                                                                    • Size 90B
                                                                                    • SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    sessionCheckpoints.json.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
                                                                                    • Size 53B
                                                                                    • SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    3870112724rsegmnoittet-es.sqlite
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                    • Size 720KB
                                                                                    • SHA256 af3007b7f831eee561e0fa5e5b18be9657c0294dc2382843ac384983c3705990
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    profiles.ini
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
                                                                                    • Size 103B
                                                                                    • SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    cached-microdesc-consensus.tmp
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
                                                                                    • Size 3.4MB
                                                                                    • SHA256 d8ccf96c760f90ffa23b508374ec7d37c5cf30e87cbdb506f81fe0fe0444bd88
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    cached-microdescs.new
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
                                                                                    • Size 8.3MB
                                                                                    • SHA256 7ee8a71db8ca5ac6337e314e40ae1174b1349dc9a8c809c770814fcde8dc354d
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    torrc
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc
                                                                                    • Size 511B
                                                                                    • SHA256 643450c19b590a7cd98ae0b2ad39dc99d721da737a9c64300e1e671e7e1b4fb3
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    omni.ja
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
                                                                                    • Size 26.7MB
                                                                                    • SHA256 6bac7c1dc154901031f9970a49b1ab902f313f61bde7b83a9b3ad52c96238a62
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    channel-prefs.js
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
                                                                                    • Size 429B
                                                                                    • SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    dependentlibs.list
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
                                                                                    • Size 55B
                                                                                    • SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    {73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
                                                                                    • Size 823KB
                                                                                    • SHA256 28e1689956b610f328c582ae45b326cf666d909c468a87f01d48a10e256dad1f
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    firefox.exe
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
                                                                                    • Size 1.7MB
                                                                                    • SHA256 d3bd730d253ca068f78561394c0097a8fd40210eb60d864574c1821b2c1c9de7
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    freebl3.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
                                                                                    • Size 941KB
                                                                                    • SHA256 af037d545d5386d49c6024a1e649fa8b1ad76c48fdc69d42f70d3984aa707eff
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    gkcodecs.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
                                                                                    • Size 8.8MB
                                                                                    • SHA256 9baf23d40555d5008d500a5ec215049d256cc8b5436169eb888ed897e0d959cd
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    lgpllibs.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
                                                                                    • Size 344KB
                                                                                    • SHA256 112498df3c75f02eadb5597f85b3c63941ec3bd6fd21b421364f318d462b6837
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    mozglue.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
                                                                                    • Size 975KB
                                                                                    • SHA256 e509b4fcdad0e0609ba7ffeecf3ece2e05784442592f2880129b8b3a33934c69
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    nss3.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
                                                                                    • Size 2.6MB
                                                                                    • SHA256 d396dc73caedc852f74c47a45401a760be8a73ab9e2b6124a1c8553c885daa1b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    omni.ja
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
                                                                                    • Size 19.5MB
                                                                                    • SHA256 19c2d067cdc2f173d698d29465d4eaf477ca949e00e0824de1437a21208abc0b
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    softokn3.dll
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
                                                                                    • Size 281KB
                                                                                    • SHA256 0667054f8fcc0780f5cbe0b3f40d5369649490571ab9c486a304df68bc1f7ec1
                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                    Submit Download

                                                                                    Tor Browser.lnk
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                                                    • Size 829B
                                                                                    • SHA256 db7573408946dc86abfb004e1eba6df39d7aee96c9d8fa8ad9fe83532724677c
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    Tor Browser.lnk
                                                                                    • Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
                                                                                    • Size 829B
                                                                                    • SHA256 1a935d2a9ff222f15dbaab21fcc9eeaeaf1145f2c3fb52d4345e441a67b04a61
                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                    Submit Download

                                                                                    memory/1160-1990-0x0000021147EC0000-0x0000021147ED0000-memory.dmp
                                                                                    Download

                                                                                    memory/1848-3339-0x00000200AA8E0000-0x00000200AA9DD000-memory.dmp
                                                                                    Download

                                                                                    memory/1848-2867-0x00000200B5210000-0x00000200B5220000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-3340-0x00000229C9710000-0x00000229C983A000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-3411-0x00000229C9710000-0x00000229C983A000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-3557-0x00000229C9710000-0x00000229C983A000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-3378-0x00000229C9710000-0x00000229C983A000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-2857-0x00007FFCF80C0000-0x00007FFCF80C1000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-2858-0x00007FFCF94B0000-0x00007FFCF94B1000-memory.dmp
                                                                                    Download

                                                                                    memory/3276-2859-0x00007FFCF79B0000-0x00007FFCF79B1000-memory.dmp
                                                                                    Download

                                                                                    memory/4836-2251-0x000002199E080000-0x000002199E1AA000-memory.dmp
                                                                                    Download

                                                                                    memory/4836-1637-0x00007FFCF80C0000-0x00007FFCF80C1000-memory.dmp
                                                                                    Download

                                                                                    memory/4836-1638-0x00007FFCF94B0000-0x00007FFCF94B1000-memory.dmp
                                                                                    Download

                                                                                    memory/4836-1639-0x00007FFCF79B0000-0x00007FFCF79B1000-memory.dmp
                                                                                    Download

                                                                                    memory/5032-2348-0x00000166DAE10000-0x00000166DAF3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5032-2479-0x00000166DAE10000-0x00000166DAF3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5032-2387-0x00000166DAE10000-0x00000166DAF3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5032-2270-0x00000166DAE10000-0x00000166DAF3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5184-2371-0x0000021F03D10000-0x0000021F03E3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5184-2480-0x0000021F03D10000-0x0000021F03E3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5184-2271-0x0000021F03D10000-0x0000021F03E3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5184-2397-0x0000021F03D10000-0x0000021F03E3A000-memory.dmp
                                                                                    Download

                                                                                    memory/5960-3513-0x000001B7C2260000-0x000001B7C238A000-memory.dmp
                                                                                    Download

                                                                                    memory/5960-3623-0x000001B7C2260000-0x000001B7C238A000-memory.dmp
                                                                                    Download

                                                                                    memory/5960-3597-0x000001B7C2260000-0x000001B7C238A000-memory.dmp
                                                                                    Download

                                                                                    memory/6156-3638-0x00000258E12C0000-0x00000258E13EA000-memory.dmp
                                                                                    Download

                                                                                    memory/6156-3612-0x00000258E12C0000-0x00000258E13EA000-memory.dmp
                                                                                    Download

                                                                                    memory/6156-3594-0x00000258E12C0000-0x00000258E13EA000-memory.dmp
                                                                                    Download

                                                                                    memory/6416-2399-0x0000023BA5880000-0x0000023BA59AA000-memory.dmp
                                                                                    Download

                                                                                    memory/6416-2373-0x0000023BA5880000-0x0000023BA59AA000-memory.dmp
                                                                                    Download

                                                                                    memory/6416-2299-0x0000023BA5880000-0x0000023BA59AA000-memory.dmp
                                                                                    Download

                                                                                    memory/6416-2482-0x0000023BA5880000-0x0000023BA59AA000-memory.dmp
                                                                                    Download

                                                                                    memory/6452-3389-0x000002A66CA70000-0x000002A66CB9A000-memory.dmp
                                                                                    Download

                                                                                    memory/6452-3583-0x000002A66CA70000-0x000002A66CB9A000-memory.dmp
                                                                                    Download

                                                                                    memory/6452-3358-0x000002A66CA70000-0x000002A66CB9A000-memory.dmp
                                                                                    Download

                                                                                    memory/6452-3415-0x000002A66CA70000-0x000002A66CB9A000-memory.dmp
                                                                                    Download

                                                                                    memory/6464-3552-0x00000158727B0000-0x00000158728DA000-memory.dmp
                                                                                    Download

                                                                                    memory/6464-3388-0x00000158727B0000-0x00000158728DA000-memory.dmp
                                                                                    Download

                                                                                    memory/6464-3357-0x00000158727B0000-0x00000158728DA000-memory.dmp
                                                                                    Download

                                                                                    memory/6464-3414-0x00000158727B0000-0x00000158728DA000-memory.dmp
                                                                                    Download

                                                                                    memory/6612-3390-0x0000028142C40000-0x0000028142D6A000-memory.dmp
                                                                                    Download

                                                                                    memory/6612-3359-0x0000028142C40000-0x0000028142D6A000-memory.dmp
                                                                                    Download

                                                                                    memory/6612-3584-0x0000028142C40000-0x0000028142D6A000-memory.dmp
                                                                                    Download

                                                                                    memory/6612-3416-0x0000028142C40000-0x0000028142D6A000-memory.dmp
                                                                                    Download

                                                                                    memory/6760-2483-0x0000026EA89C0000-0x0000026EA8AEA000-memory.dmp
                                                                                    Download

                                                                                    memory/6760-2400-0x0000026EA89C0000-0x0000026EA8AEA000-memory.dmp
                                                                                    Download

                                                                                    memory/6760-2300-0x0000026EA89C0000-0x0000026EA8AEA000-memory.dmp
                                                                                    Download

                                                                                    memory/6760-2363-0x0000026EA89C0000-0x0000026EA8AEA000-memory.dmp
                                                                                    Download

                                                                                    memory/7164-2484-0x000001393C180000-0x000001393C2AA000-memory.dmp
                                                                                    Download

                                                                                    memory/7164-2401-0x000001393C180000-0x000001393C2AA000-memory.dmp
                                                                                    Download

                                                                                    memory/7164-2301-0x000001393C180000-0x000001393C2AA000-memory.dmp
                                                                                    Download

                                                                                    memory/7164-2364-0x000001393C180000-0x000001393C2AA000-memory.dmp
                                                                                    Download

                                                                                    memory/7268-2365-0x000001D8B6A30000-0x000001D8B6B5A000-memory.dmp
                                                                                    Download

                                                                                    memory/7268-2402-0x000001D8B6A30000-0x000001D8B6B5A000-memory.dmp
                                                                                    Download

                                                                                    memory/7268-2302-0x000001D8B6A30000-0x000001D8B6B5A000-memory.dmp
                                                                                    Download

                                                                                    memory/7268-2485-0x000001D8B6A30000-0x000001D8B6B5A000-memory.dmp
                                                                                    Download

                                                                                    memory/7480-3386-0x000002AABFCD0000-0x000002AABFDFA000-memory.dmp
                                                                                    Download

                                                                                    memory/7480-3558-0x000002AABFCD0000-0x000002AABFDFA000-memory.dmp
                                                                                    Download

                                                                                    memory/7480-3347-0x000002AABFCD0000-0x000002AABFDFA000-memory.dmp
                                                                                    Download

                                                                                    memory/7480-3425-0x000002AABFCD0000-0x000002AABFDFA000-memory.dmp
                                                                                    Download

                                                                                    memory/8064-3559-0x000002BAFF170000-0x000002BAFF29A000-memory.dmp
                                                                                    Download

                                                                                    memory/8064-3426-0x000002BAFF170000-0x000002BAFF29A000-memory.dmp
                                                                                    Download

                                                                                    memory/8064-3399-0x000002BAFF170000-0x000002BAFF29A000-memory.dmp
                                                                                    Download

                                                                                    memory/8064-3348-0x000002BAFF170000-0x000002BAFF29A000-memory.dmp
                                                                                    Download