3aa42619adaf09f4634b7cd58a4e3532ddcb66e1aef2673069557ac90ff50c24

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
899s
max time network
531s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2019-wuhan-coronavirus-data.html
Size 299KB
Sample260827-mfj3wsshle
SHA256 3aa42619adaf09f4634b7cd58a4e3532ddcb66e1aef2673069557ac90ff50c24
MD5 9e7c2914075db26ace512f135aa3c56a
SHA1 6956e30fd8f2fb1390cbc924656e4d88e522d395
SHA512 7ff53b9df1d6968aa4af54e2711670cc6225f086e59c6324a60ef36ef68fd0804159b19caab29645b72a1de8a0bd1fe7c641e37cda837114ecfddecfa955700f
SSDEEP 6144:XuFUPqSaM7k9UREMj82NitCvWdpwmOJ4XP2RcrPyGjY0c4no+sEuQoPLUvS9pl8M:eFUPqSaM72UREMj82NitCvWdpwmOJ4XU
TLSH
T12664E6B1B071D23E068F529AF471AB54E397B69BD716A8E2C43FC2A881C3C84F793155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
204	1528	msedge.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	tor-browser-windows-x86_64-portable-15.0.20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	firefox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	firefox.exe

Executes dropped EXE 42 IoCs

pid	Process
5368	tor-browser-windows-x86_64-portable-15.0.20.exe
5896	firefox.exe
1504	firefox.exe
5224	firefox.exe
3876	firefox.exe
5516	firefox.exe
4448	firefox.exe
3816	firefox.exe
4708	tor.exe
5396	firefox.exe
3956	firefox.exe
2004	firefox.exe
5580	firefox.exe
7188	firefox.exe
7468	firefox.exe
7768	firefox.exe
8140	firefox.exe
7368	firefox.exe
7780	firefox.exe
6420	firefox.exe
6068	firefox.exe
1304	firefox.exe
3760	firefox.exe
4404	tor.exe
6600	firefox.exe
6596	firefox.exe
6568	firefox.exe
7344	firefox.exe
2484	firefox.exe
7312	firefox.exe
7324	firefox.exe
7404	firefox.exe
1300	firefox.exe
7452	firefox.exe
5716	firefox.exe
6252	firefox.exe
6628	firefox.exe
4684	firefox.exe
8088	firefox.exe
3384	firefox.exe
2800	firefox.exe
7628	firefox.exe

Loads dropped DLL 64 IoCs

pid	Process
5368	tor-browser-windows-x86_64-portable-15.0.20.exe
5368	tor-browser-windows-x86_64-portable-15.0.20.exe
5368	tor-browser-windows-x86_64-portable-15.0.20.exe
5896	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
1504	firefox.exe
5224	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
5516	firefox.exe
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
4448	firefox.exe
3816	firefox.exe
3816	firefox.exe
3816	firefox.exe
3816	firefox.exe
3816	firefox.exe
3816	firefox.exe
3816	firefox.exe
4448	firefox.exe
4448	firefox.exe
5396	firefox.exe
5396	firefox.exe
5396	firefox.exe
5396	firefox.exe
5396	firefox.exe
5396	firefox.exe
5396	firefox.exe
3956	firefox.exe
3956	firefox.exe
3956	firefox.exe
3956	firefox.exe
3956	firefox.exe
3956	firefox.exe
3956	firefox.exe
2004	firefox.exe
2004	firefox.exe
2004	firefox.exe
2004	firefox.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	firefox.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1528	msedge.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322998795433999"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{9CD62D08-8A0E-4058-9877-DBAC4D4464BF}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	tor-browser-windows-x86_64-portable-15.0.20.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe
3876	firefox.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1504	firefox.exe
Token: SeDebugPrivilege	1304	firefox.exe
Token: SeDebugPrivilege	1304	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1504	firefox.exe
3876	firefox.exe
1304	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1568	4628	msedge.exe	87
PID 4628 wrote to memory of 1528	4628	msedge.exe	88
PID 4628 wrote to memory of 1532	4628	msedge.exe	89
PID 4628 wrote to memory of 1532	4628	msedge.exe	89
PID 4628 wrote to memory of 1532	4628	msedge.exe	89
PID 4628 wrote to memory of 2532	4628	msedge.exe	90
PID 4628 wrote to memory of 2532	4628	msedge.exe	90
PID 4628 wrote to memory of 4280	4628	msedge.exe	91
PID 4628 wrote to memory of 5068	4628	msedge.exe	92
PID 4628 wrote to memory of 4280	4628	msedge.exe	91
PID 4628 wrote to memory of 4280	4628	msedge.exe	91
PID 4628 wrote to memory of 5068	4628	msedge.exe	92
PID 4628 wrote to memory of 5068	4628	msedge.exe	92
PID 4628 wrote to memory of 2540	4628	msedge.exe	93
PID 4628 wrote to memory of 2540	4628	msedge.exe	93
PID 4628 wrote to memory of 2540	4628	msedge.exe	93
PID 4628 wrote to memory of 4320	4628	msedge.exe	94
PID 4628 wrote to memory of 4320	4628	msedge.exe	94
PID 4628 wrote to memory of 4320	4628	msedge.exe	94
PID 4628 wrote to memory of 1576	4628	msedge.exe	98
PID 4628 wrote to memory of 1576	4628	msedge.exe	98
PID 4628 wrote to memory of 4688	4628	msedge.exe	99
PID 4628 wrote to memory of 4688	4628	msedge.exe	99
PID 4628 wrote to memory of 1432	4628	msedge.exe	103
PID 4628 wrote to memory of 4280	4628	msedge.exe	115
PID 4628 wrote to memory of 2644	4628	msedge.exe	116
PID 4628 wrote to memory of 1152	4628	msedge.exe	117
PID 4628 wrote to memory of 3652	4628	msedge.exe	118
PID 4628 wrote to memory of 3652	4628	msedge.exe	118
PID 4628 wrote to memory of 3652	4628	msedge.exe	118
PID 4628 wrote to memory of 3084	4628	msedge.exe	120
PID 4628 wrote to memory of 3084	4628	msedge.exe	120
PID 4628 wrote to memory of 1664	4628	msedge.exe	121
PID 4628 wrote to memory of 1664	4628	msedge.exe	121
PID 4628 wrote to memory of 1664	4628	msedge.exe	121
PID 4628 wrote to memory of 4804	4628	msedge.exe	122
PID 4628 wrote to memory of 4804	4628	msedge.exe	122
PID 4628 wrote to memory of 4804	4628	msedge.exe	122
PID 4628 wrote to memory of 3856	4628	msedge.exe	123
PID 4628 wrote to memory of 3856	4628	msedge.exe	123
PID 4628 wrote to memory of 3856	4628	msedge.exe	123
PID 4628 wrote to memory of 5072	4628	msedge.exe	124
PID 4628 wrote to memory of 5072	4628	msedge.exe	124
PID 4628 wrote to memory of 5072	4628	msedge.exe	124
PID 4628 wrote to memory of 4228	4628	msedge.exe	125
PID 4628 wrote to memory of 4228	4628	msedge.exe	125
PID 4628 wrote to memory of 2528	4628	msedge.exe	126
PID 4628 wrote to memory of 2528	4628	msedge.exe	126
PID 4628 wrote to memory of 2528	4628	msedge.exe	126
PID 4628 wrote to memory of 5432	4628	msedge.exe	127
PID 4628 wrote to memory of 5432	4628	msedge.exe	127
PID 4628 wrote to memory of 5228	4628	msedge.exe	128
PID 4628 wrote to memory of 4744	4628	msedge.exe	129
PID 4628 wrote to memory of 4744	4628	msedge.exe	129
PID 4628 wrote to memory of 4744	4628	msedge.exe	129
PID 4628 wrote to memory of 5368	4628	msedge.exe	130
PID 5368 wrote to memory of 5896	5368	tor-browser-windows-x86_64-portable-15.0.20.exe	134
PID 5896 wrote to memory of 1504	5896	firefox.exe	135
PID 5896 wrote to memory of 1504	5896	firefox.exe	135
PID 5224 wrote to memory of 3876	5224	firefox.exe	138
PID 5224 wrote to memory of 3876	5224	firefox.exe	138
PID 1504 wrote to memory of 5516	1504	firefox.exe	139
PID 1504 wrote to memory of 5516	1504	firefox.exe	139
PID 1504 wrote to memory of 5516	1504	firefox.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\2019-wuhan-coronavirus-data.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff659cc188,0x7fff659cc194,0x7fff659cc1a0
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,8527531634008581740,6217371513747460736,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7479177295475085701,1432163718924513678,262144 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8959022448231708701,18146450204749712468,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5993912451523502565,5174439540060268029,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10485714771642252861,14695673149119203787,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4733176260975048714,15617564865090806022,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,17451341364017414622,466525010829902477,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,11618139237720549935,7864946378909397577,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2193038331898305983,4658446752756489993,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7893929222526568614,5978773660443939793,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,7893929222526568614,5978773660443939793,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,14723318040820990955,10978286216778237971,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,11774906509362427913,4827932282819749747,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,5173875421128752574,1897209991784398782,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5008,i,1169619481950642631,3729250865960742714,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,14298379445542625586,10510231409073427264,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6380,i,12416910977003513353,6941902740568798839,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6336,i,12352916119677747800,9494960164917534743,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6876,i,12190029319510109721,583381385639113502,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5128,i,6409256240702540473,11285952023839331390,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,2249703953766361507,3142493234965653429,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6992,i,6161092644247924972,4719269950539260608,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,6378643786357755169,13293721208442936990,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,11727218210853953241,17166705323727863128,524288 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5344,i,13465099529688189817,7656595374750976850,2097152 --field-trial-handle=1372,i,8435843999483387896,4084579477482602710,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:1
  2⤵
  PID:4744
- C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.20.exe
  "C:\Users\Admin\Downloads\tor-browser-windows-x86_64-portable-15.0.20.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks system information in the registry
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -prefsHandle 2448:26451 -prefMapHandle 2452:276489 -ipcHandle 2484 -initialChannelId {9d22b0f1-af96-41d6-a24f-2a9b19c6c140} -parentPid 1504 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5516
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2324:27031 -prefMapHandle 2392:276489 -jsInitHandle 2396:242832 -parentBuildID 20260817150000 -ipcHandle 1812 -initialChannelId {c1393c4c-eaa4-4423-931c-ba1031573f3a} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4448
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -prefsHandle 2772:27718 -prefMapHandle 2776:276489 -ipcHandle 2844 -initialChannelId {b994307e-534c-4a77-8326-b34c93b61a35} -parentPid 1504 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3816
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:e652aeaa375751a5607ceeadfc47a65088fa0d0f6e4e619110eda6ab16 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1504 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:4708
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3288:27780 -prefMapHandle 3292:276489 -jsInitHandle 3296:242832 -parentBuildID 20260817150000 -ipcHandle 3304 -initialChannelId {6414a8be-ef1f-408d-99eb-aa9affa3c1cf} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:5396
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3720:27856 -prefMapHandle 3724:276489 -jsInitHandle 3728:242832 -parentBuildID 20260817150000 -ipcHandle 3736 -initialChannelId {2132e3f9-1a55-41af-bd4f-b88be349ec31} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3956
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3944:28012 -prefMapHandle 1708:276489 -jsInitHandle 1712:242832 -parentBuildID 20260817150000 -ipcHandle 2132 -initialChannelId {8ec247bc-c502-43c9-b4dc-3d7acd25292f} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2004
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -sandboxingKind 0 -prefsHandle 4160:29871 -prefMapHandle 4164:276489 -ipcHandle 4124 -initialChannelId {00332f50-bff6-4aac-94cd-6b8a30aba939} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5580
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4216:28528 -prefMapHandle 4220:276489 -jsInitHandle 4224:242832 -parentBuildID 20260817150000 -ipcHandle 4232 -initialChannelId {e7e29e0d-2f7e-4bf5-9da8-dcfa0729105c} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7188
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4520:28919 -prefMapHandle 4524:276489 -jsInitHandle 4572:242832 -parentBuildID 20260817150000 -ipcHandle 4584 -initialChannelId {4824a285-bb49-4651-b55b-6a71dcc2cd53} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7468
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2992:28919 -prefMapHandle 1988:276489 -jsInitHandle 3116:242832 -parentBuildID 20260817150000 -ipcHandle 4704 -initialChannelId {c281dd68-30ae-470d-8747-8caf402c50a0} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7768
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4068:29245 -prefMapHandle 4044:276489 -jsInitHandle 3608:242832 -parentBuildID 20260817150000 -ipcHandle 3084 -initialChannelId {7b6c07e0-b755-40fd-bf5f-5bf5b4c5afd5} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7368
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3300:30646 -prefMapHandle 4772:276489 -jsInitHandle 2800:242832 -parentBuildID 20260817150000 -ipcHandle 3316 -initialChannelId {beb83b8a-f7e9-4e6c-8c9c-3dcd2b90cdf9} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7780
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5064:29370 -prefMapHandle 5012:276489 -jsInitHandle 4992:242832 -parentBuildID 20260817150000 -ipcHandle 4384 -initialChannelId {321c3bd1-b553-4455-8080-b0e56ea5782e} -parentPid 1504 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
"C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
  "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3876
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -prefsHandle 1748:25928 -prefMapHandle 1752:276261 -ipcHandle 1784 -initialChannelId {317060af-6a08-4e1a-8d3e-aac3ea0c65b1} -parentPid 3876 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
    3⤵
    - Executes dropped EXE
    PID:8140
- - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
    "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
      "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Checks whether UAC is enabled
      Checks system information in the registry
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1304
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -prefsHandle 2188:28646 -prefMapHandle 2192:278237 -ipcHandle 2236 -initialChannelId {407020d5-dded-4448-8353-3a9a9035d173} -parentPid 1304 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 1 gpu
        5⤵
        Executes dropped EXE
        
        PID:3760
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe" -f "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc" DataDirectory "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor" ClientOnionAuthDir "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\onion-auth" --defaults-torrc "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\torrc-defaults" GeoIPFile "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip" GeoIPv6File "C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\geoip6" +__ControlPort 127.0.0.1:9151 HashedControlPassword 16:957263516d8cc93d608b28913afc68a817a0921077f11492c7a311f259 +__SocksPort "127.0.0.1:9150 ExtendedErrors IPv6Traffic PreferIPv6 KeepAliveIsolateSOCKSAuth" __OwningControllerProcess 1304 DisableNetwork 1
        5⤵
        Executes dropped EXE
        
        PID:4404
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3076:28758 -prefMapHandle 3080:278237 -jsInitHandle 3084:242832 -parentBuildID 20260817150000 -ipcHandle 3092 -initialChannelId {0bb9e86e-fb8b-436d-82db-e756bdc7882a} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 2 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6600
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -prefsHandle 3224:28758 -prefMapHandle 3228:278237 -ipcHandle 3308 -initialChannelId {485b55d0-62df-4caf-a67e-9bf42b523fbd} -parentPid 1304 -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 3 rdd
        5⤵
        Executes dropped EXE
        
        PID:6596
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 2892:28790 -prefMapHandle 2904:278237 -jsInitHandle 2908:242832 -parentBuildID 20260817150000 -ipcHandle 2884 -initialChannelId {f7d9a020-40ec-4ee1-a027-73d7cce88c81} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 4 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6568
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -parentBuildID 20260817150000 -sandboxingKind 0 -prefsHandle 2928:28831 -prefMapHandle 3616:278237 -ipcHandle 3816 -initialChannelId {49d4ea50-792e-405c-b0ad-5de6022382d7} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 5 utility
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7344
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 3948:27517 -prefMapHandle 3940:278237 -jsInitHandle 3952:242832 -parentBuildID 20260817150000 -ipcHandle 3960 -initialChannelId {dd6acb6b-a323-44e5-b6fe-ac83ed3131c6} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 6 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2484
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4088:27665 -prefMapHandle 4092:278237 -jsInitHandle 4080:242832 -parentBuildID 20260817150000 -ipcHandle 4148 -initialChannelId {62b0c75e-cb80-4832-8b5d-1589e8e6d001} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 7 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7312
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4360:27665 -prefMapHandle 4364:278237 -jsInitHandle 4368:242832 -parentBuildID 20260817150000 -ipcHandle 4376 -initialChannelId {afc8288d-0751-4034-aa8a-1e8817836c3c} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 8 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7324
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4564:27665 -prefMapHandle 4568:278237 -jsInitHandle 4572:242832 -parentBuildID 20260817150000 -ipcHandle 4412 -initialChannelId {1ab68670-2546-4897-9206-6c8192e4b77d} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 9 tab
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7404
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4792:27665 -prefMapHandle 4796:278237 -jsInitHandle 4800:242832 -parentBuildID 20260817150000 -ipcHandle 4776 -initialChannelId {1ae1f131-913a-4a9d-8762-a56673604ad4} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 10 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:1300
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4192:27665 -prefMapHandle 4188:278237 -jsInitHandle 4204:242832 -parentBuildID 20260817150000 -ipcHandle 4172 -initialChannelId {cfec14f2-728e-4090-b8d7-e35f4331482d} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 11 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7452
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4460:27705 -prefMapHandle 4476:278237 -jsInitHandle 4472:242832 -parentBuildID 20260817150000 -ipcHandle 4544 -initialChannelId {18ecdb4a-58cd-470d-aadc-51da95c746c9} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 12 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:5716
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4336:27705 -prefMapHandle 4732:278237 -jsInitHandle 4716:242832 -parentBuildID 20260817150000 -ipcHandle 4244 -initialChannelId {4ee1d46a-c435-4a97-9538-451bad135af8} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 13 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6252
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432:27705 -prefMapHandle 5436:278237 -jsInitHandle 5440:242832 -parentBuildID 20260817150000 -ipcHandle 5448 -initialChannelId {887f3ff8-4624-421f-a8bf-869ac04919e9} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 14 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6628
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5624:27705 -prefMapHandle 5628:278237 -jsInitHandle 5632:242832 -parentBuildID 20260817150000 -ipcHandle 5640 -initialChannelId {a7df1200-8c9d-4f02-98a5-cc1afcd2a0a4} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 15 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4684
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 5476:27705 -prefMapHandle 5448:278237 -jsInitHandle 5440:242832 -parentBuildID 20260817150000 -ipcHandle 5788 -initialChannelId {b3817f01-424e-4b4b-80d5-3c5cad4fb089} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 16 tab
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8088
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4436:27705 -prefMapHandle 5060:278237 -jsInitHandle 4196:242832 -parentBuildID 20260817150000 -ipcHandle 3764 -initialChannelId {a2c54802-837e-4a21-ad68-d90b3417087b} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 17 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3384
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4056:27705 -prefMapHandle 4040:278237 -jsInitHandle 4044:242832 -parentBuildID 20260817150000 -ipcHandle 3980 -initialChannelId {6bca194d-cf16-4482-a4cb-309a1139b588} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 18 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:2800
    - - C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
        
        "C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe" -contentproc -isForBrowser -prefsHandle 4040:27705 -prefMapHandle 4044:278237 -jsInitHandle 3980:242832 -parentBuildID 20260817150000 -ipcHandle 2740 -initialChannelId {9e68af36-cc90-442d-a4c0-7c0a8c169a83} -parentPid 1304 -win32kLockedDown -appDir "C:\Users\Admin\Desktop\Tor Browser\Browser\browser" - 19 tab
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:7628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2455790bde8be8d35582b70e1106ae83eee0660913f244b1cb6a86868bd8098c
MD5 2a504afd48367d6ac1e26e2f3dbbfeb1
SHA1 d707881b9a42a7b523d65914b182225cd75b7f67
SHA512 1057e0df60ad63bcf94c0db3b6ce1cfc474c44dfc290181a9f7485688d3cca3626c0283c6e7cb5c0308fb0c567fa72f0e751f95cc95b601d4552cc5455d9c050
TLSH
T1A7D0A72036AA7486E3094071B4075790675E84E5349AC203D559990B6E5A09592C72C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 78943e2e169c0a9904be10bed2c8330f494aced8c94d3cc7983ccb86c335c923
MD5 65179c822985e93f326b95a0554d2bae
SHA1 1c8596421e40d65a92d4982f11594b9c4df4d27e
SHA512 06e51e53d388f4a9806d786b37abef72b2fae6f4af0c92514234b22e60bec1d42e447522aa4a6951b372d4c90333116e6e5b1fb1c732f8b8b464467d29c21dca
TLSH
T10A616E3C09410461F3620032AFE16E1A7BB383E8F61F6DF095A06B7407F57C3C159428
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8706cd2329ef1c33e006174f4f140130944d7a688b3f60a5a978e7354bc930d7
MD5 01b185e5629790b2fa874f3b473441c4
SHA1 2a88e25da28744c7d32668cdc73179d300bcf5be
SHA512 ff71c679baa2432b75f9398206e764fbde1a83176dd29dc46bc18bfca192e3bb765bc67920707a57adabd414124dd2c83268b721682c571938765a8c99a4eaa0
SSDEEP 96:nnnGgXI1ee8+pAqqqqsz3KLmPhI7QxzL3ZxsJSLiuMxwtT436Jg8CoCe1e:nG2I1epgAqAGkmPNxPjsE8t36Jg8zCeg
TLSH
T101F18A3A089A6066FF148BB25BD15E1676F3B3CBF10BAEAF5180163027623DFC05801D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 223e795b83e05e072ede0b8e674c251ae018e92ab52a11c90ac38136e1e37a3d
MD5 a439199f8310b49c6e98f8e5c424ad55
SHA1 03204187df06afcde446b8b4fb7efcef18ee7fb9
SHA512 c096194695200d90dda4765ec79c2042a8c17372f5a3b52f446a63388bd3b144cb0502f3e0e2987ab8443182eb03052c0e341eb9045a2cb14701d339d478b144
SSDEEP 96:knGgxI1ee8+pA8qqqokz3KLmPhI7QxzL3ZxsJSLiuMxwtT436Jg8CoCeCz:LQI1epgA8AoukmPNxPjsE8t36Jg8zCeI
TLSH
T14FF18B39089A6066FF044BB25BD15E1676F3B3DBF10BAEAF5180567167A23DFC05801D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 353fca1680163d8a70e05cec1967831e8c53b0fc136ee12163a6936183ec12d3
MD5 46aaa41c576ccf4c93c5b2329ce1b2f2
SHA1 023d171c71a2ca26f40b40bc2296389cb3dffe99
SHA512 4cc38d4a35f2a2c8eaea292fa9afd8f9d1d91a2c727446cc41805e9f3e53308647d856caa150cb646bcdde660eb634b0ee866a396d1fa4f36db091715d74ab6e
SSDEEP 3:MsEllllkEthXllkl2zEXK/:/M/xT02z8K
TLSH
T1E74404047FC00C35DD0013314111C3700771F4150551D74F34D114335CC7DCC0C00104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9573b7b6-7081-4e8b-89c3-0c3e86092eb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9573b7b6-7081-4e8b-89c3-0c3e86092eb8.tmp
Size 211B
SHA256 726167750a17b87d9b68a919bd59f10d8d19e722ae9ae53c89f41d5076f8190d
MD5 093bd27ef3ac7d797285d581ec8f3119
SHA1 2f83dee2d3ca6fc999dc816cccfa0283daa4d871
SHA512 08972ba62261fa7e147f1a8e20908b8019fcfa4e00c6c2812c95c5093cda4da5070c28c0ba0169d0f7c62d133a9d081b8061a5935861ef33ed47a25e6b28852b
TLSH
T1E4D02323274430B6959C3EC5406DEC8FC73600312A82DDD814D074DD053145DA657541
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2a4f80d39b44670158bb8cdbf01b7bc98331069561519835bd868468388eefda
MD5 fd44c9d5afedf01065c3badaba1c48e4
SHA1 1c941a0ad5adba4c44a5d378796e24a20aeda4f9
SHA512 ba4648d4498f6084b84253eba43255eb4237f97dfa72cca3fb77c72af67ed25cedd1d40a47b8c2207611936282014cd2f7655d6ef332b1e282091f8640351a1d
SSDEEP 96:DBO9B3SRQfezWaPK9O5GO7gxccH4tjRTzEy2dd/twBDr7x:D09B3SRQG/PcO577gxccYtjxzT2dd/tI
TLSH
T109C19AF6C3E5862EDA1155F0DA146F1BCE1C055643AC3C5A89E4AF0BA3F24B1E152B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a3abfc2078fe5b3fa14fd502b4173d660244885705a1cb1ab5016243b3f6e486
MD5 52983a5127cb080b2a42c86a17e93517
SHA1 a23b494c3f35de176cea4e26bd1da6e7ca028be5
SHA512 ba7c763af79e9fef2c4dfa8349224c9a8a8e31304f8c90ed6d0bd2b3135819aed6df2c4083c564477f8e38b927be069b865fb3a5756af782374a676b63bf5948
SSDEEP 96:DBO9B3SRszWaPK+wKO5GO7gxccH4tjRTzEy2GD2dfGk:D09B3SRs/P/nO577gxccYtjxzT2Gidfz
TLSH
T1C3B1A9F6C3E5862EDA1155F0DA146F1BCE1C055643AC3C5A89E4AF0BA3F24B1E152B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries~RFe592fd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe592fd0.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0f6e9224f15f8534c5324f43437b91066bfd7e152f39f8fc79ca2b479242dfa6
MD5 52d120942a5a138c14391015a37422f9
SHA1 958cbb7b03693c8ed62a8a5ec63e105b09954eee
SHA512 6eb8cc1e32133d5e4e49274880d2897e4783ec68ee6ecb76cc1b1461eb6fe0de2236e9d8af1748dc766e830ad727a14057fce44e6131f24571fb01082572bece
SSDEEP 192:sxZbRMkx/f5smwj8NI8wIdpdYHW6+WNGYzQAt0IgrJ:sxZbZx/f5smwj8NI22HbGr9
TLSH
T12822A7516E28A87B8CC7D219BB15BF53E6FA5032A1941E58F6FC861C05E7ADD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 070368a95912adfcaa88eba0bdcf1bab1a1e67b2f76a9c02d575f669f1cfc237
MD5 c6ed72a8812925e1e412d5b3bb0a13b6
SHA1 bd711f16da77ee49ee539dd8bb7de9c4e46e56b2
SHA512 bd78b94e65c88716d192d64e4ca8d834827c5b547e475d710fba7d55542b47be3250be8df821e7bd5600360b5d033ceed7c1455d60120a86d2332f846328ff8c
SSDEEP 384:sxZbDmWx/f5sbwjVNIA+pcHbGzU/kM0tYt:sDDmWx/fEwjVNIAfHbxFJt
TLSH
T1BD72E8426924AD7B8CD7D619FE35BF12E6F9003299951E5CBAFCC51C04EA6ED230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c293dcee2e9da6d71a85b1a40dff973f9accd81ea3cbd2d4968c876378173535
MD5 7a39a121b0a29e0fc9b36a8ade586d41
SHA1 a97a9f059a4245c856026976b871f21e58c2d5da
SHA512 c2d8f285bc3ffa0b92eddb694ba5266db15ca121d35506e6a107cea859998f1035dd4bf1af3d288dc4d99a8a5762bcf31e150cbaf8a5100a7b7baf5b2f1e8c23
SSDEEP 192:sxZbRMkx/f5sbwj8NI8wIdpdYHW6+WNGYzQAt0Ig5OJ:sxZbZx/f5sbwj8NI22HbGro
TLSH
T1FF22B6526E28A87B8CC7D21ABA15BF43D6FA5032A1941E58F6FC861C05E76DD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 771c4760a07c193dfa75a9f907fbe07cb95858191b7814957f17893304e82bfc
MD5 c798d2f1fc99254ac68bf375463991cb
SHA1 61c5b4e6c87156b36080f645211ebe8e9fbc37e0
SHA512 8d7c065cfe15a5eb7a97b66864fb730d1becb65fc64ca3e9c63fd912fc1f626eff5a9fd0f7f38e84092ccdb7fa339ccea06c009476b6f17c0dd7cc102c3d33e0
SSDEEP 192:sxZbRMWOx/f5sbwjVNI8zsJ7dpmVYHW6+WNBYM/YzQot0Ig5kJ:sxZb7Ox/f5sbwjVNIt39HbB/ZS
TLSH
T13042C6426A646C7B9CC7D21EFA157F53E6FA0032A5D45E48F6FC9A1C08E66DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8af0e2706dea8c605289908bde0d5286e97abca318b1d5719bc6547d57b0cc00
MD5 edec56aa61c8bab673c415550450deb4
SHA1 4f85cc33c6195cb3d39877ef902e6d37354184ea
SHA512 a2bec26de6427822457d2420f3a7d6b7c8f13676ca68f11d4de037084214e667ddfdcb0d44fad85afde4ecb30ee5453fde720a05faa685c867aa142defc72ed0
SSDEEP 384:sxZbFmWx/f5sbwjVNIA+ptHbGz/PM0tYt:sDFmWx/fEwjVNIAeHbsEJt
TLSH
T1C162E8426A24AD7B8CC6D619FE357F13E6F9003299955E5CB6FCC51C04EA6ED230B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d088e55bd084f473747b5c6832c5fdaca46e294145ad43d84f452234ac1232d7
MD5 0a45690c7415c3632f013e51c436190d
SHA1 70028bbc8b2fa069204bfdb8f86fe5a71f1c4692
SHA512 758eae9e79e1ebd23f20b8a85fa625c6681eed3752d27ae3c97ce56cd82e2cf51c05c9b9f70f807e28147426171f2a9f087beea2bda98f97ae33c166dd8b20c5
SSDEEP 384:sxZbzmWx/f5sbtWvljVNIF+pcHbbzU/X60tYt:sDzmWx/fEtYljVNIFfHbuKJt
TLSH
T12372E6426520AC7B9CD6D619FE35BF12E6F90032D9955E5CBAFCC91C04EA6ED230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 00444594018b4e6f94d3199353f47ac25a845ac6e56cebaedfbd6af5897ec4af
MD5 7552554831a25f50f5512d65a6289260
SHA1 8080745954aa2ece43c6f7920713200415e0efec
SHA512 20eeb1dfa49893c7674f64bbe1c7dbc8891237f6743e7460856f1a209fdd84ffe0a14c082389b26c53f690e530aba36039ce4840ddf5cb0f38ffc8f3a19d1769
SSDEEP 768:YGk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBbroyXYs:YGk7u70WvqiEau1jai5LA3BoHs
TLSH
T1CFC2E93B740CCB7E4F800E9DEC566F977E9802C7A6988D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 624B
SHA256 c841a77dca0a2acaf9c18784a6dc5950fb0a987047c09d0c56c59060561c5c1a
MD5 2b359c8b96687cbcb2ed9df172cc73bf
SHA1 3fc659976da1555691093b276d17fa7665c0982d
SHA512 6ae36e9d9a609ef19fbcf1cf2ad44b091a23d371be4b6262e428529150b823343c5701bbcb6bcebd5c10a52e0433e2fb39193f603a58b16d65df453f64fa1de9
TLSH
T1D8F0D4154F91E926DB6405F314FA20E13371DEDC3332C457442C696A3C37288541A1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 ef0d350ed238118de3a63854f6da012b6850b97fc61de90715de76a6c395e6e7
MD5 86abaaede81076c4b48edb598cf0b5a0
SHA1 ccc6890499ff56f20776a1a70a15c0ab90662157
SHA512 d1956651129f3a2158025403d0a57d09999b96276ac9076a3a1a81a2fd2159fe682df2246625d76976ab4566c9b6c3557a683ffe11609288e0677d7d187e9c0b
TLSH
T10B51934F8C8A0F16CDBC16F314BA0894337429DC27485A17B9AC697578C332D1C6CE5A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe58d4cf.TMP
Size 624B
SHA256 2f8a6ccc16247b8c0f2ffd9e7459cebddda743bdfda8abb141f70e82c96fe95b
MD5 f9b2b02b278c48044e8926d6162a7fa6
SHA1 c0b7206cba6944a1ef78f7bbb3d9e26cea2d6ab5
SHA512 84d36b2468b1e030bbc1a0cd7eeab10c172c5be733c3610483a7e47c03db28529324d16355f9c10262b5874051f43340559998cfb77552b5eef5fbde79154258
TLSH
T11EF0239687D29D53E814097615E440F5B330CE007237E4935069A92E2C3638896120CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 75e17efa6688d5925ea5023191d600fe0bf6e4d08a690581c0dfa3bf6df2a01b
MD5 1aa706400a9e9c922dadc6e03d1fdbdf
SHA1 6492b27b32cbfd137eb552abab2d7d6169db1865
SHA512 749344dd6342159f6ff1f02e0faa454087cb8b33d761ec38333c9586e3d0861a78ee3ef1e272b2a75a5177d7c62f58f9fe0c7664679cc55b421a0684c2c899d3
TLSH
T17BA0021822800043C40253B1769621C22720D9140312536B49901788EE517458D4115D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 57fe25a8f5db1fe147c26f67b4914aa20eee543038e95006814ea0590dc867a1
MD5 617c37014fff030977a491d327d40e23
SHA1 0fd6ad38f19474e68e2dee1c851d697d803a8ace
SHA512 f1440cb52d25fd52f73e085ed5be4ab5b05b93c5f9d18042bb9229dd01b9e3a7eae3071542a61aa4df12360544b4a4f604c9e6b9122befab8282cff8eba6415c
TLSH
T161A0025C0380440AEC1351B1679217419314CF2061019B0780920084CD924C8CD5A44C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a746f5d6c9de70fc04a25bb9aade17eb1bcfc6f5badcb7983f0ac5eb0c4712f0
MD5 f3b15f0747985f7266da8227f3a32bb5
SHA1 14813c2e10a172a440c2a41c36f99fc18d720cf1
SHA512 9e17f9a99d2a2991292bf7179108b9bad0585ae5967c32ac64c56b04c764c2bba96ee52f988ad0a010ebf23823b40059461f7c1029262fde6ea8dfbcd83d89c8
TLSH
T190E068BB2DFB1820AD6F87D538B054A0818538188500EC4E3027A38730F27512406C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ee2c065061033d5a98d24ca996351c37105ab48aa6b455a73d1c64465861ef90
MD5 3cfe09093a8379e3fa622bc415e2ef49
SHA1 fc836f52813154f7ab1316e3c08c21e0c5d65f6a
SHA512 d60513e041b4ecd10ff29ed78a6a607a7348022f2a90e20e376197ac40bdf60d04fb9501b63c64aa02b6a1c0d6a91923eab010164820f608766b73eb3cdb1bef
TLSH
T1E2A002508A9AE005C489077952A551D87F955CD901151285ECD8A4DC8CF13C0BBD6506
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59352f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59352f.TMP
Size 48B
SHA256 d3485eb2f64a084b799bb474db5485267aee710a9bff7a1fd299edbec715b559
MD5 14f813e13461944914f2a40654a82d1a
SHA1 0f215db6f76fd474109daebf0d0f8f0d7c64ef01
SHA512 8958ccce796c0bfa5d1805cb9c2a16d9bb3e7e1340982e9b788cbb6e3c584fd3c23fc4f93b448ac6adaffdd16a5eda12832ee17624d5be1e5ba2a8dd52f6d320
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e5a8e4fb289aab32bdd331d5adb6ed551b03518211e4a2f1de2d072e8e8c96bf
MD5 7ee612f8aff7aef13eeb442b37fc2568
SHA1 3b006bbbb9bbaf6ad1ce288d5d7cd176234a32f5
SHA512 0746ac32157a9fa4359d756790e6e02dea73ea41952a6d4cc72883b098e3dcdbf43a46090c3d15a3c76a630110ac9b771cb55cf3756a9e5b31732930e702fe57
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYT3MIXKZqYHyNlIJKek8mVIZKW0kTyD:KIbCKc3MIKZqS2lCKekRVqKW0Sg
TLSH
T1E4A15116317A46013C7E2C48A1A5C9379F4235A33458A8AF7FB814B24E6BE524FFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593649.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593649.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 21975ce325013d30c4322fe8a7dc67fc30b35c5b2b18715f8f255632f7570bd9
MD5 dfdcce7a0d5f40cb2af854061006ffac
SHA1 7267da71b1ca7464721abbef378ab1e5e06b2cf8
SHA512 b470f23d0433f057c9d0b0f5a92e4b5d5b87add33b0046700285cb001a504ff44719994bedf649625e053e76ddb1cfc8a2139d8e93d738e5cd75f01ec99da526
SSDEEP 384:j3yFaeO8WsN2TUcWbjRZn2VkOoHugINydBRZh:j3IzhWZIRZxOmoNydBx
TLSH
T151827E76BCB45E2BAD92B142F48632079F78816BE7886F44D5DD6F1D06CA2DC130B507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 249b6cc345e52a07425fb31de43923ecfaf35be6b612195a4a20890683e9837e
MD5 47d24c2aaaa14fc443ad2dc29e2e0104
SHA1 0ae1a2cc1810c1f78c042b8835a8e2b9b4d834f6
SHA512 9377733f9b28e108e4940c64e29fa0a1e9fc0ad9e1b1e91af741add670722a308588e58cc49c315408987aff5be856391b7a0499de47a71ac1549706d1cab285
SSDEEP 384:viFZ3yFaeO8csN2t8TUNTUlIl/T6Wb5u9n2VvOoHugINydBRZh:6FZ3IzhcZtwgFA1QOmoNydBx
TLSH
T156C207F258E7993AE99D5743E77D2E039E7CC167B5846A00B3C95A1CCD861BFD306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c08aefeaf9b90b902a6749724fc72d5136b7ecc8d7ba40705fb63f9fa67af740
MD5 bd1755a4aa164eb93281854b4769c8a9
SHA1 2a7c45d0d4f5d941ba961a4974fa2da4c32eb644
SHA512 1a627399c9a42fc1286c1b8265719ab2da8da4ddbf870bea8c41c2fad4026c7dddb62228c99e6deee466bf3bc30081cb7c32379e48cba4cca60b6552bceea539
SSDEEP 192:MONa64BAQmiUyW1ZW5GBPKScC2567aDO7phU6:MONa6eAJfWE2BOjU6
TLSH
T1DF021A396C796C7B9EB2AD05F48737175FA4107BE6946B44EAE82B0C00D734C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c4ece0a2f49cf3e377ae2f884654d7dfd0e7a53845119e3cc5872b3f5c65e60
MD5 c7ee550666745083a71ba040077987c6
SHA1 04176e598a35a0ec14ec194cdc1521ffee1e9137
SHA512 6e6a3dfba925700be8fcf32512de1ee283781c3ba1c358c8f6a9cda708a708ef2fc225bbe0de281957384d4df810e0b2b7c843babfa652016a58bdfcccb40c2c
SSDEEP 384:V3yFaeO8WsN2T/T6Wb4zi2n2VkOoHugINydBRZh:V3IzhWZ/KicxOmoNydBx
TLSH
T1D0827DB6BCB46E2BAD92B142F48632079F74816BF7886F44D5DD6F1D06CA2DC130B506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 255cd8fac51a2c612a17cfafebce9c06bd2a959b638907e042cd5b92a25ab70b
MD5 eb4e5c32841717bdc0ef4d702ea98542
SHA1 d9ea12ecc905cee7af57b9231b737f1e296f6d98
SHA512 c248dba94ef3043071794042884958c376c8b8fe9879096dcbda1a42ee180765022c25f918f9ad6738c0267dc1caa12c339af4c430e62edfc677e66e051e9368
SSDEEP 384:viFw3yFaeO8esN2t8TUNTUlIlDT6WbFu9n2VNOoHugINydBRZh:6Fw3IzheZtwgV01QOmoNydBx
TLSH
T11AC218F258E7993AE9AE5743E77D2E038E7CC167B5846A00B3C95A1CCD861BFD306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 705971936768df6f2fae76eca2e5c527c19eb950b43a9c4a63814aeaff87ce88
MD5 06d6849b6f1504c0a61ffb8f75549970
SHA1 f702b89f9e49ec051acbba50715d9fce3d9b8bdc
SHA512 ffbb56763087d7f5beb6bf81d61977ed01eb7b59511d488a4b1ef3f7bb671a5ff62000dad95b915bf2c32e8d2403fe778f83b22fb4a93111c790fc460d08e66a
SSDEEP 192:aONCS64BqQmiUyCZb5GBPKScC256bePNjWwOeqsHU6:aONCS6emlbE2VvOoHU6
TLSH
T19A121C35ACA9AD2F5EA2A551F4C632075FB54167F788AF40EAEC361C01EF25C2307517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 82510117f43fca56e17ac6be13e0332efc7ce5b61e00107889569cda55056b8d
MD5 ac89dacaeed7d5cf0720640374261a1a
SHA1 7ec706c7b4e9b61e60536a59ddbfe8c2a738f88a
SHA512 54a7b36e24ef71383756ebb9ddb38463220dab0c8880afde7ded8e07461aad379072fd71b0265b27468bd530d89a8cbba3f7b6dd055f6adc3af8a708200e7acc
SSDEEP 384:viFA3yFaeO8/sNWt8TUNTUlIlDT6Wb/79n2VhWbvpVSBecDK6Ee9aChugINydBRP:6FA3Izh/FtwgV31QeTSae9aooNydBx
TLSH
T123E25CE198D75DB6D9AD9BC3A77DAD026A7CC077B0445908B3E5A92CEC4B0BFC312401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d4fdc5497d0e2be79d5c8d47ab390f9fb0033f3584f59fb99675f0a0b360cdd
MD5 66d212ad3ecdd2a4c6c43a160e2b6769
SHA1 4cbbb119e3438ee204de1b6de0d4b061af2f398e
SHA512 8f8cb5305f7aa9c089140e519f31d79a53662f62a7822617ee984c11ec79f9d10edd218aadd380be2dcd305b9daf00c19d203fe8cc5a673feb0dd6ad8d6a2c3d
TLSH
T10AE00112A70004BAC06C073404A31F102EE280B416F356659E3442AC7C333102931F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eb62e3e56d7124ebb77a6a24ceb0719e3cbed1aadbd767c047dcd568c09b2815
MD5 f16446ec216e8c66adeece3f72c6847a
SHA1 21626b3d4b894498d13a9de3798550cc337d6028
SHA512 cee67ca2c2d5db5b475078737602691b4f679d0308547b79c61a73ab4c3a19bcafe327c86ba0bb732ffa75301a3445b188816d8d3fc2ac0ba5175ae9f1914340
TLSH
T16EE00213630000FBC06C073400931B102FE2C0B007F357669D2042A83C233101D20F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58faf5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58faf5.TMP
Size 392B
SHA256 8f192dfc0f0a12912c2bbed487945cbf10c3035656bdf81b03eef1b4bbe1ce1b
MD5 334694f40fdabbd21ccef5d9f1191405
SHA1 19c10f547fc86f77d44f8c1b88ec18fb725c0794
SHA512 e239eb0adc15d7534980321ea58f60299d7c0a741fac24ee6fb8c9c18761efc278652901e3c0be1d026ff91d80d2e0de500bdc855f1447cda5ca112c7e6c07e8
MD5 SHA1 SHA512

Submit Download

2b703ffb-356b-4786-9057-e96cc045c09e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2b703ffb-356b-4786-9057-e96cc045c09e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 67e1fdfc2534bc9e283c059b42cd00a456b5f1f3ee983115c54360757caa6f48
MD5 47d0914473a770005b1480e0f09cb7fd
SHA1 83722555f4d028da19686a98d6502bede593a1a2
SHA512 82f07bc666bd1c17c7eb230a36b7fdbfa4154f57131e66539bf67c3cf3daf98db80d0b6a003f0e7faa50c43c09391c4470c02be27dbc4defa14e3422bdb92307
TLSH
T15841EB58BAE90158B3B77F5A9BF7A86D487AB8771E07D19D00110E4E4762A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn48D9.tmp\LangDLL.dll
Size 7KB
SHA256 b797e5a7de359c0c934cddef8e9d3a78e6d3d68e6ac83d2ddad915770cbace53
MD5 48125e63f130d69025cd2bbf9f3b0c4b
SHA1 e3923a75ed00cc53e2f0b3c1843598c7c1ede79f
SHA512 5b411fc88035eafee2eed3c4e1b8c14fdb09ed09ca275ec1492d7a72dcf9cf55719dc34e63c00ca64162a455339658efc958dd2abb6dfe8a363f2f24ff3bd5be
SSDEEP 96:BLIwtgI+Wdk6guTxZlx3ojaVgmR6wP3LtrlKVNtEc+InoAhrEoUK3EMbqKh:J89uTvlx4jhaX3Lt/ch4oZ3x
TLSH
T1B5F1C70E6AC010BCFD6FC23A8D3A42157BA1F521076568DF269321553EE4FE76E356C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn48D9.tmp\System.dll
Size 23KB
SHA256 4bc489ab81c6f1d7e9cc6c2e8a3157183e7b0ee5199b4c6e8044aa32da2dea1b
MD5 8213548feab7394279d2712fc12126f5
SHA1 1ada5c813c36c66789b256da1ccacd9b85a97b4f
SHA512 3b5f96cca356bbac7a87bd2695e1b95b1c8fb6c3f059e8a9ac11724708c8aaad4f7e3e404a9be1c7354b03414b18123916c2b4772ceb033a91a8c48ee724e2a8
SSDEEP 384:ecybqzYqKbo39DihgonO/U1j/HCD3Zn/MUcD9RSSvUW6OEY3yW:lybqzfko39D6gUOMhKD3ZnkjRSSJ6O
TLSH
T1DAB23C0B3AE5047DE446C13EE6671226F6B27C412B11E4DF2761B13A3E75BF01B39698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsn48D9.tmp\nsDialogs.dll
Size 13KB
SHA256 7ecc85cfcc4bde6146ed8e0067341b1a56306f94893702ee772bda8725712aeb
MD5 ff6b5961a43ba8c36434c9e707d4e6a8
SHA1 f73efb0ad4f4e9f5c716df5168f4168c2cb01ad9
SHA512 fc1da79bd1725e240f0eb259e2ae7cdd976e33f8c9b64083c9420d9a64aa2bde9251294d8cfeb70e5b93d73517c26594c04c8ebba80d9529235b02d52b0a72b3
SSDEEP 192:hVoR5bH/o9gAXCI6KW0fnFdFlCaYQZUhU+Cg8++9KdYI:hVQZ/omAh6uvLFlZX++9Kd3
TLSH
T1C252D7132AC100A9FC5BC17B99BB55228ED5F6100B5131DF026662463D72FE57B3D9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp-d2d.xpi

Path C:\Users\Admin\AppData\Local\Temp\tmp-d2d.xpi
Size 823KB
SHA256 05713eb71e43bee5a78c16c4a1e5c750b755a637c01ef1810e71f518d38fdb25
MD5 b145643ceb19daf1d46c6a80887861b1
SHA1 e51313c020900c72140b224839c1fb3027ad0f16
SHA512 7bc42719c312055302841e02c7cb03c02e4cfedbfcf2c6abb73a74f32751a7492b25dfc894126b5834c49aa464be4e3134f0ea1d33995f8504a83f14e85113e2
SSDEEP 24576:WnElb+dOvfE3Na6yyZRBY80d1DDUX2ugtG2Ru+809qDPN:QOvYa6yc2fTDx7G5+809qDN
TLSH
T1A905232BDE808819E93784B9391BE245C47A4B52A1DCF193A657B2CD4498FC06BD3DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\Caches\profile.default\startupCache\webext.sc.lz4
Size 111KB
SHA256 73ac61e047982e37143d738f976d09f3ffa457c17e4c261b980ddedd7011b000
MD5 5468fb014d11aeadfcdcd670041a8e45
SHA1 a262c21ca11a1ca718a0e096e805095b07e71230
SHA512 1d00e1cebb768f87873013269b26586401dd48d23719acbaf6f298a757708ed67db13813c24552d626fc6fe63b15f827cf46d40e0d70133efb1efb902bd91fcd
SSDEEP 3072:qIKbL46rgaZiw23g55YsLxnfDpaoZYDNcfvzb3fBonsGkoX:cbL84iwEG5DdKDOfpo6oX
TLSH
T17EB3AFBACFA68D2D94FF941DAB82853EFD273404B3A7350DC813272465C6BB46779608
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

broadcast-listeners.json.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\broadcast-listeners.json.tmp
Size 209B
SHA256 63221253f5c30efa214c2cd2adcf51a9c9f9a2c05f119b00a51c9579825c2c24
MD5 97c3738563a9448365a735f5f29ed3d5
SHA1 15a81433236ca6e6ecc4e1c8d0fdb8523b265c57
SHA512 ed98f42d5d02ab53a9e50f80b312bed4b5d05d053bec582cf9d619ef91251e86cf4f4d1123c645500fc1dc4673b49a8b7badd3f3a39f565ac643ca4fd0157ae6
TLSH
T159D0220E14177C7F4B486229F00827800B9A10093270A03DC3AEA0540A2AAFC4008190
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 82B
SHA256 84e58efe7002b3979bd085be539f0b77c4e4088cf36871d2064b955cf8e49c41
MD5 d761cff9dabf6f4fe73363c79fcc9afd
SHA1 0c21d46130d5fefa768b28034c87139463b367ea
SHA512 b6f5cb36e9ba3a698045aa5e46f567864bce095b43d5fa0b1cda3893d8a8f196903f35b2971d127a6c41d1e3550ddc40f969c619a403dc30c6b795c4e983fd00
TLSH
T1BEA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.bin

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.bin
Size 984B
SHA256 14f5294cd3331bf0ccf4e20585e3ca71642feb254702245aff285919cdc9a560
MD5 a93f638840b48c026fc66387c183377d
SHA1 aff100485ee773c26039adbe0e0a9bb3a1b819f2
SHA512 0dbe79bc79a846153335b1551c72a732fe7287631cc9fb774391a210687422964e30716b4e6f421ff4ca442cd2287757a58014012685977db93f63fbb14ce0b9
TLSH
T1EF11C484EA586235E088D73BDC9557625B307424E88F7F34742D20589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 ab3444dda5066eb5063be04eb18906e6f558b01ec92f80aab38e2a9ead5b7a84
MD5 e335604ba411753ad562fe9b65ebd9d9
SHA1 a9c01e731003b58e911d0e54ea9b682fa10c91ca
SHA512 c1114b28224a939010d495ab17670c5c43a2f126fe0a6e1b96a09c4396e65d6dcb3d20580b8de9713cd8799fcbc323c33b683f8122b02e02c59efb24510d9cc2
TLSH
T1CDA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 140B
SHA256 099dd19f45e7310bc4a028ac2ebced52b8ec8359b655e1f2c549e9d9a7a908c5
MD5 de9fe529c2d79379465d15467a51ff4b
SHA1 26110400ec0bb0326974d4b13e3de5de6f69348c
SHA512 ba980bc3176a050d898bece155b75578caf3e1893ce2811a8a4844028d4ca90e475d937046011fee3f5bf95397572278f6d69ed29a7305d8b22a3019e44e452e
TLSH
T1A2C01280E7A19804E4455237000003120344581100E2E6039014520494779243C78C09
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 b9382d692c3cab8780b86342e5fff6ce78d5b62969767fb57643f4f3b700fc49
MD5 1c2b435851c9e749d7b1488ec1fddcfc
SHA1 85af71ae8ac6549f4f9eba6930d0602e6ef1645a
SHA512 897693f470dc8aad437fc895e4f195ab3717b89a0d5971d7ffbcf961881cfca0b78bb338370f7eda6a6e48fb2f102ce0511f113c2743c7de995149f2f9e2edee
TLSH
T121A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 39447608973367d2f9deccd6b21b3bf4bda73b7405d0d153845b180a5ceae6ef
MD5 765cfb03c5a36cf59417ffe8d584751c
SHA1 536531c854be4b293fe029c06c7b48a452b7d8c0
SHA512 09b1df574279fdd1db7f7a7a342610c4d28b451ffe6aa73b875b08335a43a3de0e8eef5d0411ef8521ccac5e7bbca789941f988abea2a11ead2264735b46cb4b
TLSH
T16BA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 9934d47707fb909b6149196f695ca44da83dca6280ef5cf374ce80d3267f4e75
MD5 2f8f6019e86cdd4d6c0bf4c31f7a2f08
SHA1 9ebb64b2ee0c23be87300b30fcdcd3c1a1384598
SHA512 e76569de7ae00bc6f4c99e1e1d5d1ef781d7d552067dc30dcd39ccb7c1890e34acff7fda5a9bbbcb9e73fa57c594ffe3b5f2cc460d6f93c5c97a7b97ea95bda7
TLSH
T1AAA004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 82B
SHA256 0c6c1246ff1fcbf1ac16dfe53be24ee7891de62a4bfedeeb632faa7caee262a8
MD5 fafab26d61e6b9bc313fa05b3fc05aef
SHA1 d34798881e7916868b10321126ad51ed75dae09d
SHA512 92e04ffe3531b5fa71a51707d7d0e69bfbd9d75eaa57f54f208f0b083701cd8aca591be08d8d6e1e3d4311c647aa94545920ebde4e1c1628dd30cbe86c6ca14b
TLSH
T1C7A004C0C7F0D400FC43373F50004304034D55100571D003C4501310F0375351D35C03
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 984B
SHA256 012d1fdf5aac1c4535e14088b2853751bfd57cbceb3731e93497eaf2bf0efc35
MD5 a421ccde43f8f796ad80ef5538f049d4
SHA1 2c5059e40985bf408f1faffc38512c3dcfe2bbb6
SHA512 392dbe05c3f41936161d56da76482474a7f7e209bf5812c689d8b07e5b92dd767761e7b2032ed6795602a5b0214bc324e50e7e08a80ed909c82d8182790ca848
TLSH
T16C11C484EA586235E088D73BDC9557625B307424E88F7F34742D20589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 984B
SHA256 a7c4ffe1825165e9e35cb3997ed47379f5601c4a5ea05cc25b5245bd28f7d0ae
MD5 4a1dc12a73e1ba8c4506913996b27a75
SHA1 74530ed8797eec315a99daa8e89127cf97251f97
SHA512 0ec0953f3baf6fa3cd7e1b3a4dcd55dc38279e9165bb748758b87e80a8d0e5557d7830504b9ab6d9eae5333ed90f7657d2cdd54d143ae265e84da4c417f7148b
TLSH
T16211C484EA586235E088D73BDC9557625B307424E88F7F34742D30589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 984B
SHA256 6740443b11353d339b4a508dae4692827b24140ac1f8cb4febcf2d3030335f88
MD5 5290571a9595dbf3cf107ea94437506a
SHA1 5182c3c943828516e61ab8f6342e68f16bb9ab77
SHA512 044d1e42ba3718958b66e4396b62ea36b0a2b39444689dc52c7677ec6d260a6a0464613416ef32c0ab6b78c5c01660e1cfa5b0901acbe07da8e0d85a5a7fab1a
TLSH
T13611C484EA586235E088D73BDC9557625B307424E88F7F34742D20589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 984B
SHA256 f3780529d97f7afe2a5814e20007f48265e7838a39bf41894dbed4ee3cfc19e1
MD5 a332023696140d6abfe486e26903ea9e
SHA1 66f4a6c2d83230c900fac9c0f6d2b0db1598a617
SHA512 431a1fcd0e831c47b38f75549d6e6e60114095c404b3e6ac1742f69ed65563ef6c98f26cd7b018082261247214baad8569d222fd29d6433e0af8e2379a7a0535
TLSH
T1D511C484EA586235E088D73BDC9557625B307424E88F7F34742D30589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 984B
SHA256 09803e5a2a0d3588c5c6def85244d59b3fc6e755d42ca037d06169bf8c3e1611
MD5 75f5d803d9180d3450d3a186c3c58cdd
SHA1 ff3e18683ce3c20ad86d11e9421160903734ab96
SHA512 fd2d82f4fc2703bf9cf262c0d95335e971e0ca1ba2c847d96e73dbcbb593c4f06f7bd233a367f143c1c3b47cc3b8295b7101b7f7b9bb400a69232b8589810a06
TLSH
T17911C484EA586235E088D73BDC9557625B307424E88F7F34742D20589E5962A22DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 0eaef01d16dd7d2d813c4f7482bba657ca739d9fc6382ab8680f591cf0b98525
MD5 56da8d3353e992cf7cde075118f72740
SHA1 dd9ff02d732a34e3872c17c5f54249609d03ffac
SHA512 56497793a6824dbb1787f39bc65e399d506cab5a8843289dabb5f921979d3b1c9f28804f69e2280ee501ea61569a5acf3bccbeeab13e3e8f6615ee8a6c628c79
TLSH
T18A110884EA586639E088C73BDC9557624F307425E88FBF34702D705C9E6A62A32DE83D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 3db43f0e626536cdf9cdf03c5014dab7618aeed98f8372130abc6efe960bc8da
MD5 8a7dc31708315f770c18bac652b703fa
SHA1 c175358d858721b93d95527c55065b53d6425da3
SHA512 01636909b297066c20efd803a87cc1aa7b77980b062de19c8438170b550d3f7b8bdf2f2586f666619f1e53a53ed2539549c38eee33e7d121c14de8ba0f8498aa
TLSH
T1A5215C84E6585539E0C8C63BDC951B925F307415D88F7F35702D601C9E5A71932DE93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 850215e9081a49df9ed593f07e91dabd74316639f807857417afafca9b0de506
MD5 adc780688b05302404e9e0238e6bfb8f
SHA1 d7eb664398d8886f9ff2ab124897a2b0c8f99213
SHA512 08587ce8d0c5f0bb606a960dbe1fee8c4816578603bba5707a7d501020f793942f556c5016acb5cd7344166373dea82e3dbc23c116bc05a704c6b4e81ed2bc84
TLSH
T11F215B84E6985539E0C8C73BDC925B925F307025E88FBF35702D605C9E6A72932DE93D
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\datareporting\glean\db\data.safe.tmp
Size 1KB
SHA256 2de4a192148a1043d7538bfc10ff0f3ca017a536a491a9b1ff01ae345e6d98d8
MD5 a667d6a58d9bfbef1ce76331a3aa3211
SHA1 a1cfdf13a5842c2df4dd04d67441bfcdab625eca
SHA512 80fe2051bd41fd699ca41d143400fd7044729ccb4872bb733ee3363a01cbe282e954a0236123a3b41d859a1cadf39f4876c457d04cc8d1867f11ddd8ed5e3134
TLSH
T1D3213884E6985539E0C8C73BDC965B925F307025E88FBF34702D605C9E6A72932DE93D
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\extensions.json
Size 17KB
SHA256 0ca998cd440658ac30be7c295edc9f58c98ac12b48f5b2d347734d8c12654518
MD5 4c52c4948159a2591720b79eae7e7f91
SHA1 e2c815cefca4ffd6ba2616f4f2f63df5df33e453
SHA512 c5e72064a6fcffa77306f731e358dd6746ff46eb21265f75954fe7f022a23f3896f998b3979fbae458d7102fbfc1fe4edbc5b64e6bb183331eb667940ebf5cff
SSDEEP 384:Liz6PON1ln8TOk/RPlsvu2Yj/7GoT9L4HRL4HiL4HBL4HC:Lyh8rwu29e4p4w454i
TLSH
T1AB82863859589F79398A66C75837BC84517D47ABE19C8C36B8AA8F0C11F827C4B7710F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite-wal

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\places.sqlite-wal
Size 192KB
SHA256 f2156a11364ca4e65684b6a21b9310529ec820442479155ca33b4dd69c497590
MD5 99f8537286cbf09d15078d54a52d0601
SHA1 054d8af07b5650654c2a55b4c40c4b07fd28453c
SHA512 e849e3d903faba040032a2aac0392347c687b004dbc24fd189b738e1e5d2c32f8e5d059f9e6cc7c9b52cc5604905d0eb3a1506e460aaae25f5514a3792aba6d1
SSDEEP 12:KnIQjYShMVkuKKjeB1BczyFcEzo6gciBDnqjJuH2hVl/l:KnMShMV9hMkQciogiBDY5Vl/l
TLSH
T19E1422721B708854CEEB78B3876F910C05613C1182BCFA1D470A012BDA53DB2FF011D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 4KB
SHA256 e102c8d887020a526b0bcaafba5c8eb18e95b1553af6bccbef643dc196d2a0ab
MD5 b51b60d288030cbda2af383f6e54a10d
SHA1 61aea786f6a51dd958471e4a5ee061b968a380ee
SHA512 a1b1c0ae291f2bb457f7e0ba9922307544d947bcaffb2ffe0499bdac8c4e54783e806132685055c33ba930abd215aad04e8f35d332159ff80bb801392f669d31
SSDEEP 96:xHBTnqGqwytbzvzqzxz8FtPpn7Hi2BejW/QCBw8pe:SRwyt/z7H94CBw8pe
TLSH
T115A1126895488F7F68B5377CAC694C7197B2053BBBBF68C610A540C8150CF7882F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 cf3d5f2f913ef32f42cf206145daf30ea8182f206e4df50f9f86d089e0b42935
MD5 baf4b2311b54f8ba9feed9d5af83648d
SHA1 25803b7c18e4826cb3e57d6fb26dd446f125dd79
SHA512 71c7e34678e18cbfbab4ec8c0cf511c2f4510be650f03fdf29ceec9086927940c783cf09ed508d6324e022b471171c216eb11e8ce0fd87bc987a9e01d84a95d1
SSDEEP 96:xH8TnqGqwYtbzvzqzxz8FtPpn7Hi2BejW/QCBw8p12i5:9RwYt/z7H94CBw8pT5
TLSH
T1EBB1146895448F7F68B6377CAC68487156B2053B77EF68C610B640C8150CF7486F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 5KB
SHA256 589309b219063840139115a0bc164f3dbf6e905282d243f9f0cb0cff038c9784
MD5 9cf6f777c3234de287e650a9cc1db4fe
SHA1 1ef38c6beae8d1a1e8107fb4bf1ed99427c6dbe0
SHA512 da2672e592bcbb2afe427b8b436b36ee04492b9b632d0877360f4a330cb35bf2dad99090c75d6d7b5751ca5fe16eed2f515ff9a68895f75ee02adf0e48d35930
SSDEEP 96:xH8TnqGqwYtbzvzqzxz8FtPpn7Hi2BejWnQCBw8p12iEGS:9RwYt/z7H9QCBw8pTy
TLSH
T1A2B1146895488F7F68B6377CAC68497196B2053B77AF68C610B540C8150CF3886F5AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 af0760475356b5922168921ded3bbc6238fab98c867743644f356a60e4272d76
MD5 6f34f77471c8599ee9e264e47a72ccff
SHA1 1f39707adfee59c6c19fdaff0a3e1e08ea86aa1a
SHA512 9e27d4adddf9a8fc6bc26c48a5121b05725c82c5553e08ca6d8a28cd1ba273a8aa4aed964875c1eff8cda431e0ff4c11acfc2c6b293b76cc7a4c785408f3430a
SSDEEP 96:xH8TnqGqwY8bzvzqzxz8ntPpnWHi2BejWnCUBw8/ky0MT3AiVGS:9RwY8RzWH9CUBw8/ky0MT/f
TLSH
T145D1EF68A6488F7F68B6367C6C64497156B2053BB7FF68C610B640D8150CF3482FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs-1.js
Size 6KB
SHA256 984267ae7afc6d07d2b24287bd8e77267fe2802fd61d0068a0206c96b2c16eee
MD5 1321f602a0cbebf540d0f52e9ee3c470
SHA1 508518062abcc6a129769fb1bb71b039295af9a1
SHA512 654118de60ef91e6d0dd1a941ea084e06ab09c6487d82c2a2eedb346a458eccfd0b249c79b95f6060d3a71227e3c1891b506e891708cb7f4a5e80a81762d72e0
SSDEEP 96:xH8TnqGqwYJbzvzqzxz8ntPpnWHi2BejWnCUBw8/kR02T8I3AiVGS:9RwYJRzWH9CUBw8/kR02wI/f
TLSH
T169D1F068A5488F7F68B6367CAC68497156B2053BB7BF68C710B640C8150CF3482F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 1KB
SHA256 32d6ec47511b90d80fb1b3ee7ba08ebd12cd5fe32055fc5fbb21ed35a3d43b03
MD5 9c35edf89cfe88fd25fa1d67acf7ad0c
SHA1 957dbc3bd4d28296d027bd7ed216d268800664f6
SHA512 edc9761a8056b36f43a785d5018dc971f668d2a572f1d32fb88d2b0664621e05f6bd0b9f0f52292087412246fe50a6e06137a4835c4c6e515b87268bb5be3a7d
TLSH
T1B541996585488F7F69B533ACAC1941B197B3443ABBFF68C211B540D4151CF3882FA9EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 2KB
SHA256 335712ce09abc57330a65d6e095994a55deeda5c5bd35a74e07a75d33bfa679b
MD5 f15b7630cb088012979db79f79eb481a
SHA1 f5546a7fca4de627226a664ec2458c033904fda3
SHA512 79853a8fe369c25c4788865a36d710df0b79bda4323b6bcdbc85ac1735c2a589d99c93e5ecf3e1d84fe628242e14a7d01c812b0787916b7b57b04036e723d6f0
TLSH
T19151002595488FBF5CB537ACAC1945B1D7B34136BBBF78C610E54088150CB3882F69EB
MD5 SHA1 SHA512 TLSH

Submit Download

prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\prefs.js
Size 660B
SHA256 853fa7bc846d53eaa41fdb6ef3ad4d05b09345c1e35c76bf341084090d9f7dea
MD5 b4544f6e351677e03f9fcf49ea04325c
SHA1 5ec4e17d78c9d4d2797b3ed0c4843921b84b3719
SHA512 4ce8789a531c7b4265059e08d38c6b151ab1186b9b7875ef5be23028578e933f63999a662aa58cd6ed8c5ee568a3f1e73d76834118e8a8bd57b894b0ee6173fe
TLSH
T114019ED65D454FBF51E52198DC0943E1D3614639F0AF684416B8C0981225F3501E6AFB
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
TLSH
T1D4B01205C8181030CD43140873743B429B2E00B231500100317CF88C203B0134556883
MD5 SHA1 SHA512 TLSH

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\sessionCheckpoints.json.tmp
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
TLSH
T10190024AC8590431DE42251823647B90A61E04A254250101526CBC88046B0155486483
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 488KB
SHA256 457ade2c387ac2d521b1a763a47158cf27b8b600dc4d5e516ec446c596876f97
MD5 2c1a2f7b2e7ad8166e49cd475e26466f
SHA1 b3ebac6a557031187814047ebc44a0d3ae9ab39e
SHA512 9469906fcc481401ba586363c279dcbdfe974b6e8f38075e855b5d46e5e084a0b23e2c4c7389cc0a221f2242aeeb62b3c92331032cc77b32a51883bef1973b59
SSDEEP 3072:R/tXerOp6TeeDWprEyi0kKSFqgEB92RdjYCqPMjFve:R/tXerzTtDkr8HKuqge2VqPz
TLSH
T164B40BD35853C57AC2721CF7F2C392AF3E0D827A44AE4A7DB626811C9B698454FE5332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 584KB
SHA256 b8c5a6b318ae656e485e9799e7558020e7f345c33ae1ea0f0a5ac0dd154d5610
MD5 c3fe46db5461e2f285d7add9fd2f4e64
SHA1 11e6c3f79a8eabf5b1b6338726b292256cb1b748
SHA512 bb8b7814c32d321ff1a694c7023debfd7e9b408b3801f4e6fe853bd40b4356948a73cf85eb4329b2ce8aefc6d6c939655558f1b4cfd26c5798d24c42871d741d
SSDEEP 6144:1/tXerqhtDkrsHKuqgew86YMaewXYyH3y3CXP+0WjseHPcHQ+:1lXeu5HKJ15XYW/+pjm
TLSH
T171D41AD3A8538176C6721CF3F2C392AF3E0D85BA84AE47B9B617811C9B188555FE5332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profiles.ini

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profiles.ini
Size 103B
SHA256 11dedeb495c4c00ad4ef2ecacbd58918d1c7910f572bbbc87397788bafca265c
MD5 5b0cb2afa381416690d2b48a5534fe41
SHA1 5c7d290a828ca789ea3cf496e563324133d95e06
SHA512 0e8aafd992d53b2318765052bf3fbd5f21355ae0cbda0d82558ecbb6304136f379bb869c2f9a863496c5d0c11703dbd24041af86131d32af71f276df7c5a740e
TLSH
T15DB0120B231CF04308312E15244902F6C8201C1C7011B01551C4110D3343D1334CB661
MD5 SHA1 SHA512 TLSH

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdesc-consensus.tmp
Size 3.5MB
SHA256 cc6f87d1ec8aab7a1cf242be1ce4d449b911e3578bad56590a40248769081f2d
MD5 6ed34c8d53a6d9723f8774e59ad85e8a
SHA1 50065eead3ebd8f746cde7a2aa9ff88249dcc037
SHA512 b025a6d68f7c68192f0c6d06e042e8107e3f912edbc11477540f7ebcc9d602938fb015fb0cf8f030abc06925b6f3374cd4ced8438e1c4a2e32ee85460cba5ac2
SSDEEP 24576:Xro53PucjuiYE4rFj+3bIVtl3JzQr0F/tkhYPfNF1KW:78WDicFaIVq4Flh
TLSH
T1460633EA97124EEAD32609DBE510FF7BF33F1725C2486F94296F48EA7205091762093D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cached-microdescs.new

Path C:\Users\Admin\Desktop\Tor Browser\Browser\TorBrowser\Data\Tor\cached-microdescs.new
Size 18.3MB
SHA256 57e6c6c682ec85dee39cc9fd6e7b59bb9b18597a28aa86a6c60fd2b0be3d312f
MD5 53c67ac744ee50459b958216b0d233b6
SHA1 7d6ef0a7b3401b0a48899b0547c7cd21ecb6bef5
SHA512 f125ee77c1b2e3f808d1e701e565cff7e55b17b7d9959711f634812f7a92b65fa095cf75c0dfa831c166ce97e9978cca29b71aae5a5f4a6c2b2d5c21d4b8d3f5
SSDEEP 24576:RGVqoVTamVvwVA7VrVEV0FGVtaQuHVFWhAdSV1X6ViVUdIEXVnUVMhcSImVYsVwm:qbNLFzB+8SZH5Je
TLSH
T1DD17AFEA899B00C14E05E7CDEC2607C3DF144A3E0B6441A176AAB6677F7329FC15EA35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\browser\omni.ja
Size 26.7MB
SHA256 598be0235313b08c6893b5b249e5a5c895916335f620a92ae79ecdfc5ee56bba
MD5 18a5da37d8e9130b82d89dd8d415586e
SHA1 fca9d625f8b32bcf378c70b2efcd67ca201ee3c5
SHA512 1213aac1f43000d22f1ecf60dbd9c0944f68aa22cf810fe3b514a6fd649398d1a52ec6cc404eae8c8ecc1207822cc07c756d6b71b01f2265dbe4d510cb194b19
SSDEEP 786432:9zcIH2jnrCHUti1j/E/dSrTwIipCLXfOTWfeiwynwuG:WjnrHtiF+dSfryJTBiHnwl
TLSH
T11C57F1A1E23E402BEE439B7FFC00D583F465D497818A38A7795A05F4998B78C478DF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

channel-prefs.js

Path C:\Users\Admin\Desktop\Tor Browser\Browser\defaults\pref\channel-prefs.js
Size 429B
SHA256 7d9d37eff1dc4e59a6437026602f1953ef58ee46ff3d81dbb8e13b0fd0bec86b
MD5 3d84d108d421f30fb3c5ef2536d2a3eb
SHA1 0f3b02737462227a9b9e471f075357c9112f0a68
SHA512 76cb3d59b08b0e546034cbb4fb11d8cfbb80703430dfe6c9147612182ba01910901330db7f0f304a90474724f32fd7b9d102c351218f7a291d28b3a80b7ac1e5
TLSH
T1CAE0A36B1588933B11503A9AF3124481B2165DAD6175CA545018D0646F0BA2165F9FDE
MD5 SHA1 SHA512 TLSH

Submit Download

dependentlibs.list

Path C:\Users\Admin\Desktop\Tor Browser\Browser\dependentlibs.list
Size 55B
SHA256 612e53338b53449be39f2e9086e15edc7bb3e7aa56c9d65a9d53b9eb3c3cc77d
MD5 a515bc619743c790d426780ed4810105
SHA1 355dab227f0291b2c7f1945478eec7a4248578a0
SHA512 48ecd83a5eb1557dfabfaf588057e86fb4b7610f6ece119d6d89a38369d1c9426027520ce5b6d1cc79a4783b9f39ac58afb360cc76e05bbe8bbbd5128c5d395b
TLSH
T1C6900252006F40226145A5A1684D890C80186146DC9101901567260E16259C008D456D
MD5 SHA1 SHA512 TLSH

Submit Download

{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

Path C:\Users\Admin\Desktop\Tor Browser\Browser\distribution\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
Size 823KB
SHA256 28e1689956b610f328c582ae45b326cf666d909c468a87f01d48a10e256dad1f
MD5 50d3a1d9ed7769b9cb595f4e96fb6b00
SHA1 7a0e87e9b477d4f77179537eff368c609b69e486
SHA512 cb1ea01716fbf2a7ecc5387c2d9430d11be583ab5d8065fda705b568564cea4025b32a3a845584b21296faf12ad8b8a7e5159b541f7e7d5864c8a6f32dc59b18
SSDEEP 24576:GcTWp3NCmEl5Tldxlruf9cNAJbd2NyARU3d7XV+9ZNkN:whcdldxBIqiJmtU3d7XmkN
TLSH
T1B005232BDD904816E93788B9396BE284C1BE4A42A5D9F157A90672CD40D8FC43BD3DCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox.exe

Path C:\Users\Admin\Desktop\Tor Browser\Browser\firefox.exe
Size 1.7MB
SHA256 d9bdc4a3b3af51dcf693d341f5280d7135b2c24e3ca682b259cd99c539e91c47
MD5 290337d1ce12de7c1d713af3dd333028
SHA1 c82c31f5e65c4e99f45782bd3fcf5db70e3b195e
SHA512 4a42426c7cc863bcb8da3d19638727244b44748519c16b8408214248aa939f2967abae59386b3694d1c6d7c1266077c5e388fe5b83c37bb85bcaed54188c3749
SSDEEP 49152:bDktjXTNrBhZJbkHsdAculFwfEgooooodooooobcwE:EtzxkHsdAUt
TLSH
T181857E1FF39502D9DC59D1B0868A5221FD35BE718B90A9CB9B603B212D366F49F3E708
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

freebl3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\freebl3.dll
Size 941KB
SHA256 a8cb4d6aab6124f4201f0b56c33b63c1f2f23bb5042b2391f42edb3fd4443711
MD5 84fa124a2fe1237fdc92b0c4244ceaab
SHA1 210b0804e3ed893844b0c08ac4ae71ad7ed48cd0
SHA512 8624b5e64e4ae99e6726f026ffaf8fe2564374956e9d824bf305eaa46d22ab8359f6241f71e17062a5dcbd838e1b1224584619a87930d619caa50bb5335d4cb7
SSDEEP 24576:QK3KNVkpVPQ7+oBl/fUUxvfZMqvwkq6+hi:N3ompS7+oBlNMqYkS
TLSH
T191254A43E6A252D8D1EACDBD064AF563B911B80E4B3634E75BC55B1239B0BE07238F47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gkcodecs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\gkcodecs.dll
Size 8.8MB
SHA256 fa4eeddd0eccbb5bff2574aaeff3cd225ecd53a40bbf18f8d033b5e5611fbaa1
MD5 5f96a7c15dc851d74745289a0d387a50
SHA1 dcd12f164b1fb94e809123fda20e4ad3cd13c96b
SHA512 5c20b1e901f31f4790cec9f1922007e467a2a89df7db2a8d2c507f58af1a86a05b56418ae00173d6513b46b5b7f0193caca08b25690cb3b064a9d04bc5c45659
SSDEEP 98304:9Ll0fF2fvaYQ86PFP+KxOn9y1Oyf+KzHD2tPTSYHqT7gy7piZ:95AFYaYP6oSXhyGYHqT7gy7
TLSH
T18E967D8EF26351B8C51BCC74427EAA22BD18385E83155AF727D956343BB2BC06B39F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgpllibs.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\lgpllibs.dll
Size 344KB
SHA256 54d737e0347c5995e07ca6f126fd08eb6d2356c33a5b79519627d07d9f561982
MD5 073a5a4331f3769a5d7677878ce0fd93
SHA1 fd4e45a7496c7d2ea31fa50610e55e35b7a28035
SHA512 3e2173a47cb22895b8fae6ab56cbefe39a90d56c5383d898fac43afd0b5e4031008a34b4135b183a29053d0d51f803a55936b6f7fd5d15961bb21d30fedde087
SSDEEP 6144:CDCB0jZjeTNVCWaARAlKIGv8VIGCzv8dHlDmk2zH2ahnhvg5bCb:mCkZ6TNVeAROGvWJa
TLSH
T1CF745A56D9840879E87BA43892BBD719CB7A3C9407A59DCB07A067112F6FFC062FD710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mozglue.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\mozglue.dll
Size 975KB
SHA256 8cc0f0098675ad182d454d4443e7ce33f12082148948d72daf108cb667da7b1c
MD5 07019c67ee78ca8df9b2d8b768c790cc
SHA1 8fc481b5d73b307ff414eac5d1c79f8d7f9b60f3
SHA512 4af369a7d44d10fef2416a12d6ea570b3c9baea0562c1ebf388b40acf0b9fb0b438268165ebd8fd50895973997445a144c88ab71d235a6aed57be7b2b540eee7
SSDEEP 24576:3VwKmBoLK3igU0wrxA1+2TpBc5F8WRjRQFf00000Yb:lwKmBoEikwrxA1lTo5F8WRjmFf00000
TLSH
T13C259D07F29644EDD82AD2B8931BA232F971FC450B24B9DF069097252F75BE0673EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nss3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\nss3.dll
Size 2.6MB
SHA256 12ef7c23b38435ece35a1efad83365f9269eeb107e912caeb54200d0c44a146e
MD5 f912f97fb17b33bda2971746f356d741
SHA1 e1e2229a00895d388078a5053c0b1bd4bed7885b
SHA512 9542f93e8baffd65dcce59dc7fd1072d929a70eb46a2f7d01258fa81d888bf613e0a7f10ce51b2123c50084342652e4f6045c16bd404bd06855e8e3371b7d7be
SSDEEP 49152:oyVU5jBgkDG32f477R3GdjTjuFmi50ArjdNtrnStrMiaHslHmSWlK+saOXhhhhhE:oyui3HoeV50U9K+s/hhhhhhhhhhhhhhT
TLSH
T19CC58D13F29610EDC42AC2B5974B5632F9B2B4054B246AEF52A0CB353FA1FD06B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omni.ja

Path C:\Users\Admin\Desktop\Tor Browser\Browser\omni.ja
Size 19.5MB
SHA256 4bf4f8a93b9e7cc04d6e944aa130543d3c17e4d223774a4fd2ab72a9b2abc56e
MD5 d4eec64b2c0bedf3f83932125e82b87f
SHA1 4c6bbc27d595bf47e9e1e2e817fa553b472321ad
SHA512 d0e981ddc630858afb01461ce1490b4cdc07aad9e55adfed31521c39ca92ceb883bcc480e48d7eaf707e358ea1fbe0d68eb92593a417656f240874ed482a39df
SSDEEP 393216:+T/Cgcn6RQefq/23M83GAOwUwfVf7Qymm+WTNMKoOqFXy4b88v:+T6gc6+2883qt8vpbMKoOkXr
TLSH
T16827F1A2E23B6027DF439ABFEC95C1637424D48BC10E6896342547F4A95FBDC0BC9E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

softokn3.dll

Path C:\Users\Admin\Desktop\Tor Browser\Browser\softokn3.dll
Size 281KB
SHA256 ac9dce44099273731d4a6024c7bf2b7550b4374fed2a646c7f5e54a5a007c284
MD5 02d0a00a950a5440fd23bc68456ba954
SHA1 39a83ebcbd357ad5d18c66d32028fb0db2c83a6e
SHA512 253b1e2c88749094728869e9aef64ec73f544cedb5a6accc3cd7175eb7b4142adff30276b5b50022256f2bc613006409c9ead49c4652e481309159c7cd1753e0
SSDEEP 3072:Iwt47NWXxdpLRAoH6vtEqlKqJv0sIzUuMJnm5lJeep1cMjaW8+CNCOCTC8CyC0qk:IfNWjJ6TKEvw3p1cUa0Yz+xnMCF9
TLSH
T167542913F3C2A1E9D808C1B5A24B5733B5B7B8104724AACF93649B253EA4BD47B3D794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tor Browser.lnk

Path C:\Users\Admin\Desktop\Tor Browser\Tor Browser.lnk
Size 829B
SHA256 a4ea149429b3d618cf280cd664c1f8d8289fb023ae27511b51d2e6d31765ca10
MD5 91a1706310ff021f1cf17ca1d38f1d4b
SHA1 a8368cff1519a4521f94e25ff9ef33be655a73f3
SHA512 90316e12e00a93c7631428355f83003a27f1927f5255acf23f517cc629ba40289eb583c09b8bb99604bc15d4c2502b67314789386321b76c0bf6c6f9ab0ed443
TLSH
T1CD011BC007D72A02E2B445B741765B2196723C584E5F14C9C09EE2420AB77A39218B13
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-4320-0x00000203C0AC0000-0x00000203C0B6C000-memory.dmp

Download

memory/1304-4304-0x0000022F548E0000-0x0000022F549DD000-memory.dmp

Download

memory/1504-1827-0x000002626A070000-0x000002626A080000-memory.dmp

Download

memory/2004-2424-0x00000248432E0000-0x000002484338C000-memory.dmp

Download

memory/2484-4313-0x00000176AC7B0000-0x00000176AC85C000-memory.dmp

Download

memory/2800-4542-0x00000209D4EE0000-0x00000209D4F8C000-memory.dmp

Download

memory/3384-4476-0x0000026AF3250000-0x0000026AF32FC000-memory.dmp

Download

memory/3956-2422-0x0000024644E60000-0x0000024644F0C000-memory.dmp

Download

memory/4448-2291-0x000001F2AFFB0000-0x000001F2B005C000-memory.dmp

Download

memory/4448-1685-0x00007FFF73AF0000-0x00007FFF73AF1000-memory.dmp

Download

memory/4448-1683-0x00007FFF73E00000-0x00007FFF73E01000-memory.dmp

Download

memory/4448-1684-0x00007FFF755D0000-0x00007FFF755D1000-memory.dmp

Download

memory/4684-4472-0x000002BDFBB80000-0x000002BDFBC2C000-memory.dmp

Download

memory/5396-2421-0x000001FEC7850000-0x000001FEC78FC000-memory.dmp

Download

memory/5716-4450-0x000001F8CC2C0000-0x000001F8CC36C000-memory.dmp

Download

memory/6252-4470-0x0000027A642D0000-0x0000027A6437C000-memory.dmp

Download

memory/6420-3495-0x000002CE3DB30000-0x000002CE3DBDC000-memory.dmp

Download

memory/6568-4306-0x0000021CB6070000-0x0000021CB611C000-memory.dmp

Download

memory/6600-4305-0x000002A25F710000-0x000002A25F7BC000-memory.dmp

Download

memory/6628-4471-0x000001CBC4740000-0x000001CBC47EC000-memory.dmp

Download

memory/7188-2431-0x000001DEBBBE0000-0x000001DEBBC8C000-memory.dmp

Download

memory/7312-4316-0x000001ED77830000-0x000001ED778DC000-memory.dmp

Download

memory/7324-4317-0x000002E2E45F0000-0x000002E2E469C000-memory.dmp

Download

memory/7368-2900-0x000001D4F3020000-0x000001D4F30CC000-memory.dmp

Download

memory/7404-4318-0x000001FF03580000-0x000001FF0362C000-memory.dmp

Download

memory/7452-4366-0x000002217EE90000-0x000002217EF3C000-memory.dmp

Download

memory/7468-2432-0x000001BF629C0000-0x000001BF62A6C000-memory.dmp

Download

memory/7628-4603-0x0000021DEFAF0000-0x0000021DEFB9C000-memory.dmp

Download

memory/7768-2433-0x000002B80D250000-0x000002B80D2FC000-memory.dmp

Download

memory/7780-2912-0x00000188B1BF0000-0x00000188B1C9C000-memory.dmp

Download

memory/8088-4474-0x000001A0A7640000-0x000001A0A76EC000-memory.dmp

Download